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Foreword 


As  the  nation’s  most  technologically  advanced  sendee, 
the  Air  Force  relies  absolutely  on  cyberspace  to  perform 
its  war-fighting  missions.  Underpinning  this  competency 
is  the  ability  to  command  and  control  cyberspace  opera¬ 
tions,  something  the  authors  argue  is  in  need  of  a  fresh 
approach  if  the  Air  Force  is  to  effectively  fly.  Tight,  and  win 
in  cyberspace. 

The  authors  assert  that  the  lack  of  an  effective  cyber¬ 
space  C2  structure  critically  reduces  the  responsiveness  to 
combatant  and  Joint  task  force  commanders  and  increases 
the  difficulty  of  integrating  cyberspace  capabilities  into 
operational  plans  and  execution.  The  traditional  military 
hierarchies  currently  used  for  cyberspace  C2  do  not  have 
the  agility  to  deal  with  the  high  velocity  of  change  that 
characterizes  cyberspace.  Instead,  the  authors  argue  for 
flexible  organizational  structures  to  match  the  complexity 
and  pace  of  the  cyberspace  operational  environment. 

As  with  all  Maxwell  Papers,  the  Air  War  College  pub¬ 
lishes  this  study  in  the  spirit  of  academic  freedom  and 
open  debate.  We  encourage  your  engagement  on  the  issues 
the  paper  raises  and  solicit  your  responses. 


Commandant.  Air  War  College 
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Introduction 


Although  the  concept  of  command  and  control  (C2)  is 
firmly  embedded  in  US  war-fighting  doctrine,  organization, 
technology,  and  operations,  a  definitive  method  for  cyber¬ 
space  C2  has  not  been  established  across  the  Joint  force. 
This  is  despite  ample  evidence  that  the  joint  force  is  not 
optimally  organized  for  C2  of  cyberspace  operations.  On¬ 
going  intrusions  to  the  tune  of  six  million  per  day  and  mas¬ 
sive  exfiltration  of  information  remain  unabated.  Attacks 
appear  to  be  growing  ever  more  sophisticated  and  difficult 
to  detect.  In  addition,  the  armed  forces’  offensive  capabilities 
are  unnecessarily  segmented,  being  that  both  the  legal 
authorities  and  technical  capabilities  are  wholly  enabled  by 
agencies  other  than  the  Department  of  Defense  (DOD).  This 
situation  critically  reduces  the  responsiveness  to  combatant 
and  joint  task  force  commanders  and  increases  the  difficulty 
of  integrating  cyberspace  capabilities  into  operational  plans 
and  execution. 

Tlie  central  thesis  of  this  paper  is  that  any  approach  to 
cyberspace  command  and  control  must  be  founded  on  the 
nature  of  the  cyberspace  domain  itself.  To  investigate  this 
proposal,  this  study  examines  possible  alternatives  for  cyber¬ 
space  C2  that  are  based  on  the  nature  of  the  strategic  envi¬ 
ronment.  the  nature  of  the  cyberspace  domain  itself,  and  the 
way  in  which  conllict  must  be  approached  in  this  domain  in 
order  to  improve  the  armed  forces’  ability  to  successfully 
compete  in  cyberspace.  The  paper  provides  background  on 
the  pertinent  threats  arising  in  cyberspace;  the  definition  of 
cyberspace:  and  the  nature  of  the  strategic  environment, 
cyberspace,  and  competition  in  cyberspace.  Next,  a  review  of 
C2  models  and  associated  organizational  forms,  including 
the  current  DOD  approach,  is  presented.  A  set  of  cyberspace 
C2  criteria  is  then  derived,  followed  by  an  analysis  of  the 
models  in  light  of  the  criteria.  Using  the  results  of  the 
analysis,  implications  for  C2 — with  particular  emphasis 
on  organizational  structure— arc  addressed. 


Background 

In  late  2005,  several  media  outlets  published  reports  of  a 
DOD  code  named  computer  intrusion  set  titled  Titan  Rain. 
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These  reports  outlined  a  concerted  and  lengthy  effort  by  sup¬ 
posed  Chinese  computer  hackers  who  were  systematically 
infiltrating  DOD  systems  across  the  globe.  Their  intrusions 
were  described  as  efficient  and  rapid:  ‘They  would  comman¬ 
deer  a  hidden  section  of  a  hard  drive,  zip  up  as  many  files  as 
possible  and  immediately  transmit  the  data  to  way  stations 
in  South  Korea,  Hong  Kong  or  Taiwan  before  sending  them 
to  mainland  China.  They  always  made  a  silent  escape,  wip¬ 
ing  their  electronic  fingerprints  clean  and  leaving  behind  an 
almost  undetectable  beacon  allowing  them  to  re-enter  the 
machine  at  will.  An  entire  attack  took  10  to  30  minutes.”^ 

These  intrusions  resulted  in  huge  amounts  of  data  being 
transferred  outside  the  United  States  to  ultimate  destinations 
unknown.  While  the  actual  types  and  specifics  of  the  data  lost 
remain  classified,  suffice  it  to  say  they  included  operationally 
and  tactically  relevant  information  that  could  assist  an  adver¬ 
sary.  More  disturbing  is  that  the  intrusions  could  take  place 
at  aU  and  that  it  normally  takes  the  DOD  quite  a  long  time  to 
even  notice  an  intrusion  has  taken  place.  This  does  not  bode 
well  for  a  zero-day  intrusion,  which  is  integrated  into  a  more 
conventional  type  of  an  attack.  The  point  of  the  zero-day  at¬ 
tack  would  be  to  slow  our  response  down  long  enough  to  give 
our  adversary  an  asymmetric  advantage,  with  the  end  re¬ 
sult  being  dominance  over  US  forces. 

To  meet  these  and  other  intrusion  attempts,  the  DOD 
has  relied  upon  an  exceedingly  hierarchical  and  authority- 
lacking  organizational  C2  structure.  This  has  led  to  a  sys¬ 
tem  that  finds  itself  in  a  reactive,  defensive  crouch  vice  one 
that  can  execute  active  defense  measures  to  preempt  un¬ 
relenting  intrusions  while  keeping  cyberspace  available 
and  allowing  freedom  of  action  for  users  and  war  fighters. 
More  specifically,  the  military  is  using  the  traditional  tem¬ 
plate  of  assigning  responsibility,  without  adequate  authority, 
to  a  single  combatant  command  (COCOM),  United  States 
Strategic  Command  (USSTRATCOM).  As  this  paper  shows,  it 
is  widely  recognized  that  cyberspace  is  declared,  at  the 
highest  levels,  as  the  newest  domain  of  warfare.  However, 
unlike  the  other  war-fighting  domains,  cyberspace  responsi¬ 
bilities  are  assigned  to  a  COCOM  vice  a  "service  equivalent.” 
Service  equivalent  means  that  primary  air  responsibilities 
reside  with  the  Air  Force,  land  operations  with  the  Army, 
and  maritime  activities  with  the  Navy  and  Marine  Corps. 
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For  these  domains,  no  one  COCOM  executes  operational 
responsibilities  across  other  COCOMs'  lines  of  authority 
and  responsibility.  Nor  do  the  various  service  chiefs  attempt 
to  direct  air,  land,  or  maritime  operations  within  a  different 
COCOM.  This  is  not  so  with  cyberspace:  for  this  domain, 
the  military  treats  a  domain  of  warfare  organizationally  dif¬ 
ferent  while  utilizing  conventional  C2  structures  that  result 
in  signiticant  C2  challenges. 

However,  functional  component  commands  do  exercise 
combatant  command  authority  over  assets  of  all  the  services, 
not  unlike  geographical  combatant  commanders  do  once 
they  are  assigned  or  attached  forces.  But  the  similarity  ends 
there.  Unlike  the  functional  commands,  USSTRATCOM 
does  not  enjoy  the  ability  to  command  and  control  the  ser¬ 
vices*  cyberspace  forces  in  a  unified  manner  to  ensure 
cyberspace  superiority. 

Nowhere  is  this  borne  out  more  than  in  the  military's 
own  documentation  regarding  C2  of  cyberspace.  Joint  Task 
Force-Global  Network  Operations  (JTF-GNO),  the  DOD's 
operational  and  tactical  command  for  cyberspace,  pub¬ 
lished  the  Joint  Concept  of  Operations  [CONOPS] /or  Global 
Information  Grid  Network  Operations  [GIG  NETOPS]  in  2006. 
In  this  document,  JTF-GNO  published  a  chart  (fig.  1)  de¬ 
signed  to  help  guide  it  in  deciding  when  and  how  it  might 
intervene  and  exercise  C2  over  the  GIG  during  an  event. ^ 
Based  on  the  chart,  the  DOD  is  using  traditional,  geograpli- 
ically  based  thinking  in  an  attempt  to  delineate  artificial  C2 
boundaries  when  the  global  nature  of  cyberspace  argues 
against  this  approach. 


Figure  1.  JTF-GNO  matrix  to  manage  incidents  (Reprinted  from 
USSTRATCOM,  Joint  Concept  of  Operations  for  Global  Information  Grid 
NetOps  [version  3],  4  August  2006.) 
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Some  might  claim  that  cyberspace  is  purely  an  enabler 
best  viewed  as  a  functional  area.  Even  if  this  were  true,  the 
current  command  structure  does  not  reconcile  with  the  nature 
of  the  domain.  Unlike  the  US  Transportation  Command,  the 
US  Joint  Forces  Command,  or  other  functional  COCOMs 
which  are  organized  around  their  functional  area,  cyber¬ 
space  is  relegated  to  one  of  many  missions  under  the 
USSTRATCOM  umbrella. 

Further  complicating  the  picture  is  a  recent  secretary  of 
defense-directed  organizational  change.  In  a  November  2008 
memo.  Secretary  Robert  Gates  directed  the  USSTRATCOM 
commander  to  “place  [JTF-GNO]  under  the  operational  con¬ 
trol  of  Commander,  Joint  Functional  Component  Com¬ 
mand  [for]  Network  Warfare  [JFCC-NW]).“^  This  arrange¬ 
ment  further  creates  gaps  and  seams  as  the  DOD  attempts, 
through  a  traditional,  hierarchical  approach,  to  exercise 
C2  over  the  cyberspace  domain.  Instead,  the  environment 
in  which  cyberspace  is  embedded  necessitates  a  C2  struc¬ 
ture  that  recognizes,  embraces,  and  takes  advantage  of 
the  nongeographic  nature  of  cyberspace. 

The  cyberspace  environment  can  best  be  characterized 
by  the  acronym  VUCA:  volatility,  uncertainty,  complexity, 
and  ambiguity.  As  this  paper  illustrates,  rapid  technologi¬ 
cal  advances  and  increases  in  the  use  and  pervasiveness  of 
cyberspace  coupled  with  aggressive  adversaries  create  a 
volatile  environment.  The  DOD,  along  with  the  rest  of  the 
world,  is  uncertain  about  the  future  uses  and  exploitations 
that  will  occur  in  cyberspace  and  the  impact  to  our  military 
and  society  should  the  current  intrusions  we  suffer  from 
advance  in  a  destructive  manner.  Furthermore,  the  do¬ 
main’s  technological  aspects  and  usage  make  it  difficult  to 
understand.  All  of  these  factors,  along  with  the  challenges 
of  attributing  cyberspace  intrusions,  combine  to  create  an 
environment  of  frustrating  ambiguity.  The  correct  military 
response  lies  in  establishing  a  C2  structure  for  this  new 
domain  so  that  the  armed  forces  can  not  only  execute  day- 
to-day  defense  but  also  fight  through  future  intrusions  in 
time  of  war. 


4 


Cyberspace:  A  Definition 

To  begin  a  discussion  on  cyberspace,  one  must  first  de¬ 
fine  and  reach  a  common  understanding  of  the  term.  Much 
writing  on  this  topic  has  occurred  over  the  past  decade  as 
cyberspace  matured  and  as  the  DOD  realized  that  a  new 
domain  and  form  of  warfare  had  materialized. 

The  term  cyberspace  has  come  to  be  accepted  universally 
as  what  we,  as  humans,  created  and  now  inexorably  rely 
upon  both  in  a  military  and  civilian  sense.  It  was  first  coined 
by  the  novelist  William  Gibson  in  his  1982  story  titled  ‘’Burn¬ 
ing  Chrome”  and  then  published  in  his  1984  nov^el  Nenro- 
mancer.'^  However,  his  definition  differs  greatly  from  our  cur¬ 
rent  understanding  of  the  concept.  To  wit,  he  defines 
cyberspace  as  ”a  consensual  hallucination  experienced  daily 
by  billions  of  legitimate  operators,  in  every  nation,  by  chil¬ 
dren  being  taught  mathematical  concepts.  .  .  a  graphic  rep¬ 
resentation  of  data  abstracted  from  banks  of  every  computer 
in  the  human  system.  Unthinkable  complexity.  Lines  of  light 
ranged  in  the  nonspace  [sic]  of  the  mind,  clusters  aird  con¬ 
stellations  of  data.  Like  city  lights,  receding.”^  As  one  can 
quickly  tell,  Gibson  s  idea  of  cyberspace  hardly  applies  to  our 
reality.  Like  the  Joint  Publication  (JP)  1-02,  Department  of 
Defense  Dictionary  of  Militarij  and  Associated  Terms,  defini¬ 
tion  of  cyberspace,  the  universal  understanding  of  cyber¬ 
space  does  not  include  a  description  of  a  ‘’consensual  hallu¬ 
cination,”  ’’unthinkable  complexity,”  or  ’’lines  of  light.” 
Although  we  have  embraced  the  term  cyberspace,  the  DOD 
quickly  rejected  the  definition  submitted  by  its  creator. 

Enamored  with  the  possibilities  of  cyberspace,  the  term 
was  employed  in  many  contexts  with  many  different  mean¬ 
ings  and  definitions.  The  accepted  DOD  definition  as  pub¬ 
lished  in  JP  1-02  prior  to  August  2006  states  that  cyber 
space  is  the  ‘’noiional  environment  in  which  digitized 
information  is  communicated  over  computer  networks. 
Once  again,  the  concept  of  a  ’’notional  environment,”  that  is, 
one  that  does  not  exist  except  in  one’s  mind,  is  encountered. 
As  there  are  very  real,  physical  pieces  to  cyberspace,  this 
definition  does  not  accurately  describe  it.  However,  efforts 
to  properly  define  it  or  discuss  the  verv’’  nature  of  cyber¬ 
space  in  any  type  of  official  capacity  were  met  throughout 
the  past  decade  with  indifference  or  outright  stonewalling. 
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In  2003  the  president  of  the  United  States  recognized  the 
importance  of  cyberspace  to  the  nation  and  attempted  to 
define  it  in  the  National  Strategy  to  Secure  Cyberspace  as 
“composed  of  hundreds  of  thousands  of  interconnected 
computers,  servers,  routers,  switches,  and  fiber  optic  cables 
that  allow  our  critical  infrastructures  to  work.”*^  While  an 
admirable  effort,  coordinated  across  the  entire  US  govern¬ 
ment,  this  definition  deals  mainly  with  hardware  aspects  of 
the  domain  and  fails  to  recognize  that  cyberspace  is,  in  fact, 
a  domain  and  does  not  really  add  more  to  the  discussion 
past  the  definition  provided  by  the  DOD  in  JP  1-02. 

A  significant  breakthrough  occurred  with  the  publication 
of  the  2006  Quadrennial  Defense  Review  (QDR),  The  QDR  is 
the  fulfillment  of  the  statutory  requirement  in  10  US  Code, 
section  118,  which  requires  the  DOD  to  “conduct  a  compre¬ 
hensive  examination  (to  be  known  as  a  ‘quadrennial  defense 
review’)  of  the  national  defense  strategy,  force  structure, 
force  modernization  plans,  infrastructure,  budget  plan,  and 
other  elements  of  the  defense  program  and  policies  of  the 
United  States  with  a  view  toward  determining  and  expressing 
the  defense  strategy  of  the  United  States  and  establishing  a 
defense  program  for  the  next  20  years.  Each  such  quadren¬ 
nial  defense  review  shall  be  conducted  in  consultation  with 
the  Chairman  of  the  Joint  Chiefs  of  Staff.”^  This  high-level 
document,  a  coordinated  effort  across  the  entire  Joint  Staff, 
acknowledged  cyberspace  is,  in  fact,  a  domain  not  unlike  the 
traditional  domains  of  warfare  (air,  land,  sea).  However,  the 
QDR  in  a  sense  backed  into  the  declaration  of  cyberspace  as 
a  domain  by  treating  it  as  a  fait  accompli.  It  uses  the  term 
cyberspace  as  a  de  facto  domain  as  passages  pulled  from  the 
document  illustrate. 

•  “Capabilities  to  locate,  tag  and  track  terrorists  in  all 
domains,  including  cyberspace."^ 

•  “Contribute  to  the  nation’s  response  to  and  management 
of  the  consequences  of  WMD  attacks  or  a  catastrophic 
event,  such  as  Hurricane  Katrina,  and  also  to  raise  the 
level  of  defense  responsiveness  in  all  domains  (e.g.,  air, 
land,  maritime,  space  and  cyberspace)  if  directed.’’ 
(emphasis  added) 
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Having  treated  cyberspace  as  a  domain,  the  QDR  did  not 
find  it  necessary  to  define  the  domain,  leaving  that  for  follow- 
on  efforts.  However,  it  did  create  the  necessary,  official  envi¬ 
ronment  to  begin  shaping  the  discussion  toward  cyberspace 
being  officially  declared  as  a  domain  of  warfare  with  all  the 
associated  challenges  and  opportunities. 

Immediately  building  upon  the  efforts  of  the  QDR  and 
driven  by  foreign  intrusions  against  the  Nonsecure  Internet 
Protocol  Router  Network,  the  Joint  Staffs  Communications 
and  Information  Directorate  (J-6)  led  a  chairman  of  the  Joint 
Chiefs  of  Staff-directed,  staffwide  effort  to  develop  a  strategy 
to  deal  with  cyberspace.  As  part  of  the  effort  to  create  the  first- 
ever  National  Military  Strategy  for  Cyberspace  Operations 
[NMS-CO],  the  authors  arrived  at  a  DOD-wide  coordinated 
definition  of  cyberspace  as  “a  domain  characterized  by  the 
use  of  electronics  and  the  electromagnetic  spectrum  to 
store,  modify  and  exchange  data  via  networked  systems 
and  associated  physical  infrastructures.”^*  As  Dr.  Kamal  T. 
Jabbour,  senior  scientist  for  information  assurance  at  the 
Air  Force  Research  Laboratory  in  Rome,  New  York,  accu¬ 
rately  points  out. 

The  word  “domain"  instead  of  “environment"  earries  legal  impliea 
tions  under  the  laws  of  armed  conflict.  “Electronics  and  the  eieetro 
magnetic  spectrum"  refer  to  the  wave-parlicle  duality  of  radiation 
which,  when  moduiated  with  information,  creates  a  signal.  “Data 
and  networked  systems"  refer  to  digital  information  and  application 
programs,  and  the  computers  and  networks  on  which  they  e.xist.  in 
other  words  data  and  applications,  at  rest  and  in  motion. 

Cyberspace  consists  of  more  than  the  Transmission  Con¬ 
trol  FYotocol/ Internet  Protocol  (TCP/IP)-based  Internet, 
though  to  be  sure,  it  is  the  Internet  that  currently  domi¬ 
nates  what  most  people  think  of  as  cyberspace.  There  are 
thousands  of  protocols,  software  architectures,  and  hard¬ 
ware  implementations  that  comprise  cyberspace.  This  in¬ 
cludes  networks  not  based  on  the  Internet  Protocol,  such 
as  specialized  military  networks,  networks  not  connected 
to  the  Internet,  and  networks  that  use  different  or  pro¬ 
prietary  communications  protocols.  Examples  include  Link 
16  networks  that  use  a  time  division  multiple  access  method 
and  standardized  message  formats  and  the  Signaling  Sys¬ 
tem  7  protocol,  which  ties  together  the  world's  telephone 
switch  network.  The  point  here  is  that  cyberspace  is  more 
than  Just  Internet-based  computer  networks. 
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Building  upon  the  definition  provided  by  the  NMS-CO, 
the  Office  of  the  Secretary  of  Defense  staff  continued  to  re¬ 
fine  the  definition  and  finally  arrived  at  the  current  defini¬ 
tion  which  is  incorporated  into  JP  1-02  and  is  the  official 
DOD  definition  of  cyberspace:  global  domain  within  the 

information  environment  consisting  of  the  interdependent 
network  of  information  technology  infrastructures,  includ¬ 
ing  the  Internet,  telecommunications  networks,  computer 
systems,  and  embedded  processors  and  controllers.”^^  This 
definition  is  sufficient  to  enable  further  discussion  about 
cyberspace,  its  place  within  the  traditional  domains  of  war¬ 
fare,  and  the  need  to  establish  effective  command  and  con¬ 
trol  structures  enabling  the  military  to  operate  effectively 
within  and  through  the  domain. 

The  Nature  of  Cyberspace 

One  central  and  vital  point  must  be  understood:  the 
value  of  cyberspace  is  derived  from  the  information  that 
flows  through  it.  This  continuous,  massive  exchange  of  in¬ 
formation  has  made  cyberspace  indispensable  to  modern 
civilization  and,  thus,  central  to  modern  military  opera¬ 
tions.  The  volume  of  global  Internet  traffic  per  year,  esti¬ 
mated  to  range  from  3,000  to  5,000  petabytes  (10^^  bytes) 
and  the  fact  that  overall  Internet  traffic  is  growing  at  50  to 
60  percent  yearly,  are  enough  to  provide  ample  support  for 
this  assertion.  This  phenomenon  results  from  a  combina¬ 
tion  of  technological,  economic,  and  sociological  factors  and 
gives  rise  to  a  rich,  dynamic,  and  ever-growing  web  of 
human-to-human,  human-to-machine,  and  machine-to- 
machine  interactions.  New  applications,  such  as  Web  2.0  or 
social  networking,  digital  television  streaming,  and  the 
“executable  Internet”  promise  to  open  innovative  avenues 
to  conduct  commerce,  stay  in  touch,  and  fight  wars.  The 
armed  forces  would  do  well  to  anticipate  dismptive  threats 
to  emerge  from  cyberspace  given  the  domain’s  facility  to 
generate  innovation  and  create  crosscutting  change. 

Innovation  and  change  are  hallmarks  of  cyberspace.  It  is 
important  to  understand  that  the  cyberspace  infrastructure, 
like  the  information  that  flows  through  it,  does  not  remain 
static.  The  technologies  and  architectural  approaches  that 
comprise  cyberspace  will  continue  to  change  over  time. 
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meaning  tliat  the  fabric  ol' cyberspace  itself  will  evolve.  Ad 
vances  in  electronics  engineering,  fabrication,  integration, 
and  production;  improved  computing  architectures,  network¬ 
ing,  and  information  exehange  methods;  and  emerging  nano 
technologies  and  biotechnologies  promise  to  transform  to¬ 
day's  cyberspace  into  ever  more  potent  forms  with  more 
pow^erful  capabilities  for  information  transmission,  storage, 
processing,  and  depiction.  Another  critical  point  is  that 
cyberspace  will  continue  to  become  increasingly  complex, 
espeeially  in  terms  of  scale  and  control.  Cyberspace  is  com 
prised  of  billions  of  devices— each  with  its  own  hardw^are, 
software,  and  purpose — with  billions  to  follow.  This  results 
in  an  extremely  heterogeneous  systems  environment  that  is 
becoming  less  and  less  amenable  to  direct  and  per\^asive 
human  control.  P'rom  a  military  standpoint,  this  evolu¬ 
tional  reality  drives  an  enduring  requirement  for  aggres¬ 
sive  science  and  technology  researc  h  that  will  in  turn 
translate  into  systematic  alignment  and  lidding  of  effec¬ 
tive  cyberspace  operational  capabilities. 

Cyberspace:  A  Man-Made  Domain  of  Warfare 

Cyberspace  is  both  linked  to  and  distinguished  from  air, 
land,  sea,  and  space  in  that  it  is  a  man-made  domain  estab- 
lishc  d  through  the  use  of  electronic  technology  and  softw^are, 
lirmw^are.  and  hardw^arc  programs  specilically  designed  to 
manipulate  eleetromagnetie  energy  into  encoded  signals.  In 
one  sense,  cyberspace  is  exactly  like  the  other  physical  do¬ 
mains  in  that  it  relies  on  a  scientific  reality — in  this  c'asc  the 
eleetromagnetie  spectnim — that  is  governed  by  physical  laws 
(e.g..  Maxwell’s  eejuations).  How^ever,  cyberspace  differs  from 
the  other  domains  in  that  technology  is  an  essential  factor 
for  its  existence.  Cyberspace  is  a  man-made  domain  in  the 
sense  that  the  transmission  of  encoded  electromechanical 
signals  is  only  possible  through  the  use  of  human  designed, 
manufactured,  and  organized  clectronics-based  technology. 

Cyberspace  is  also  similar  to  the  other  domains  in  that  it 
is  globally  distributed,  w^hich  adds  to  the  C2  complexities. 
Unlike  the  other  domains,  cyberspace  is  owned  by  eommereial, 
state,  or  private  interests.  It  is  not  as  some  w^ould  say  a 
"global  commons"  or  "a  natural  asset  outside  national  Juris¬ 
diction  such  as  the  oceans,  outer  space,  and  the  Antarctic."*^ 
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Within  some  areas  of  the  DOD  the  term  global  commons 
has  taken  on  a  sort  of  buzzword  status  and  is  used  to  sup¬ 
port  strategic  concepts  that  have  US  military  forces  engaged 
in  the  protection  of  access  to  the  global  commons.  Except 
for  very  narrow  situations  such  as  public  cable  access  or 
amateur  radio  frequencies,  the  principles  of  sovereignty, 
property  rights,  and  commercial  enterprise  apply  to  cyber¬ 
space,  which,  in  turn,  under  US  and  international  law, 
place  constraints  on  when  and  how  military  force  can  be 
used  in  cyberspace. 

The  effort  to  classify  cyberspace  as  a  part  of  the  global 
commons  is  best  viewed  as  a  movement  to  internationalize 
its  control  and  subject  it  to  supranational  legal  regimes. 
This  controversy  centers  largely  around  the  Internet,  which 
since  1992  has  been  overseen  by  a  consortium  of  commer¬ 
cial.  governmental,  academic,  and  research  organizations 
under  the  auspices  of  the  Internet  Society.  In  addition,  the 
Internet  Corporation  for  Assigned  Names  and  Numbers 
(ICANN),  which  controls  the  assignment  of  Internet  address 
space  and  is  contracted  to  the  US  Department  of  Commerce 
to  perform  this  task  on  behalf  of  all  Internet  users,  has 
come  under  fire  from  both  commercial  and  governmental 
interests  as  to  whether  ICANN  has  the  authority  to  accept 
or  reject  the  establishment  of  new  domains.  The  Internet 
Society  and  ICANN  exemplify  the  regulatory  and  standards 
complexity  that  accompany  operations  in  cyberspace. 

Cyberspace  is  also  distinguished  from  the  other  do¬ 
mains  by  its  potential  to  drive  extremely  high  operational 
speeds.  Whereas  operations  in  the  other  domains  are  sub¬ 
ject  to  much  lower  limits  on  speed  due  to  gravitational, 
hydrodynamic,  astrophysical,  propulsive,  and  ballistic 
forces,  cyberspace  operations  can  occur  at  much  higher 
speeds.  For  instance,  the  transmission  of  optical  signals 
has  been  registered  at  two-thirds  the  speed  of  light,  which 
is  orders  of  magnitude  faster  than  speeds  achieved  in  the 
other  domains.  Practical  examples  include  AT&T’s  40- 
gigabit-per-second  transmission  capability  on  its  Internet 
backbone  and  the  1.2  seconds  it  takes  for  a  one-way,  end- 
to-end,  geosynchronous  satellite  transmission.^^  The 
speed  at  which  events  occur  in  cyberspace  serves  to  trans¬ 
form  the  classic  time-space  planning  factor  by  reducing 
the  tyrannies  of  time  eind  distance.  With  innovations  occurring 
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continuously,  the  upper  limit  of  operational  speed  in  cyber¬ 
space  will  only  continue  to  increase. 

However,  increased  operational  speed  is  not  automatic 
and  is  attenuated  by  a  number  of  factors.  Perhaps  most 
obviously,  speed  is  affected  by  machine  failures  and 
faults.  In  addition,  just  as  in  the  other  domains,  adver¬ 
sary  operations  and  effectiveness  of  friendly  planning, 
decision  making,  and  operational  processes  place  a  drag 
on  operational  speed.  Unless  cyberspace  operations  are 
thoroughly  augmented  with  technological  automation — to 
include  more  precise  and  cogent  methods  for  producing 
situational  awareness  and  moment-by-monient  domain 
understanding — the  human-induced  latency  associated 
with  planning  and  decision  making  will  negatively  impact 
operational  tempos,  resulting  in  a  failure  to  capitalize  on 
the  potentially  high  speeds  afforded  by  the  domain. 

Another  limitation  on  operations  is  the  difficult  task  of 
tracing  and  attributing  malicious  activity  in  cyberspace. 
Adversaries  conduct  attacks  using  multiple  nodal  hops  and 
diverse  network  paths  that  can  transit  many  national 
boundaries.  Even  if  an  attack  is  successfully  traced,  it  be¬ 
comes  another  task  altogether  to  correlate  the  attack  to  the 
actor  who  initiated  it,  all  of  which  takes  time.  In  addition, 
anonymity  is  readily  achieved  using  obfuscation,  masquerade, 
and  deception  techniques.  With  sufficient  expertise,  espe¬ 
cially  when  augmented  by  knowledge  available  in  the  Inter¬ 
net,  cyberspace  becomes  a  sanctuary  where  information 
exchanges  are  conducted  in  secrecy  and  large-scale  attacks 
can  be  launched  with  low  probability  of  attribution.  This 
affords  a  tremendous  asymmetric  advantage  to  a  cyber¬ 
space  attacker. 

Asymmetric  advantage  is  also  associated  with  the  case  at 
which  cyberspace  can  be  accessed.  Operating  in  cyberspace 
is  an  inexpensive  proposition  as  compared  to  the  costs  of 
entry  to  compete  militarily  in  the  other  domains,  especially 
air  and  space.  Commercial  computing  technology  and 
connectivity  can  be  readily  obtained  along  with  extremely 
sophisticated  attack  and  exploitation  tools.  Successfully 
competing  in  cyberspace  is  not  restricted  solely  to  nation-states. 
Organized  crime  and  extremist  organizations  increasingly 
exhibit  the  type  of  agility  and  innovation  previously  rcserv^ed 
for  state-run  military-intelligence  establishments  to  conduct 


sophisticated  technical  operations.  As  the  scale  and  reach 
of  cyberspace  capabilities  grow,  nonstate  actors  should  be 
expected  to  increasingly  use  cyberspace  as  an  asymmetric 
offset  to  a  state  s  conventional  forces  and  technical  means, 
while  state  actors  will  gain  skill  in  the  conduct  and  integra¬ 
tion  of  cyberspace  operations  with  operations  in  air,  land, 
sea,  and  space.  Because  of  its  dependence  on  cyberspace,  the 
United  States  is  especially  vulnerable  to  such  operations. 

Another  intricacy  of  the  cyberspace  domain  is  that  very 
little  in  the  way  of  international  law  exists  with  regard  to  its 
use.  Unlike  the  other  domains,  from  a  legal  standpoint, 
cyberspace  is  not  yet  considered  a  “place”  as  such,  and 
therefore  traditional  territorial-based  law  for  international 
conduct  does  not  apply  cleanly  to  the  domain.  Given  the 
speed  and  general  anonymity  with  which  information  flows, 
it  is  difficult  to  clearly  delineate  a  state’s  territorial  boundary 
in  cyberspace  at  any  given  moment.  Such  a  capability  would 
require  the  instantaneous  mapping  of  electronic  traffic 
flows  to  precise  geographic  points  as  well  as  the  technical  and 
procedural  means  to  identify  and  police  such  flows.  In  addi¬ 
tion,  since  cyberspace  is  based  on  an  open -access  philosophy 
that  is  embedded  within  the  protocols  and  architecture  upon 
which  it  is  built,  “fencing  off’  the  domain  into  territorial 
sections  would  require  a  massive  reengineering  of  its  fun¬ 
damental  architecture.  So  the  legal  problem  is  as  much 
conceptual  and  technical  as  it  is  legal,  which  confounds  the 
search  for  a  solution.  In  the  meantime,  in  the  international 
arena,  it  can  be  said  that  all  actors  have  tremendous  free¬ 
dom  of  action  in  cyberspace. 


Cyberspace — US  Legal  Authorities 

Within  the  US  government,  legal  authorities  for  cyber¬ 
space  are  distributed  among  several  different  departments, 
agencies,  and  commissions.  The  United  States  Code  pre¬ 
scribes  defense  in  Title  10,  commerce  in  Title  15  (technical 
standards-making),  law  enforcement  in  Title  18,  intelli¬ 
gence  gathering  in  Title  50,  and  communications  regulation 
in  Title  154  (Federal  Communications  Commission).  In  addi¬ 
tion,  the  National  Security  Council  has  oversight  respon¬ 
sibility  for  cyberspace  policy  making,  and  Congress  shapes 
the  cyberspace  legal  environment  through  law  making. 
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le^slativc  language,  and  funds  appropriation.  In  contrast  to 
the  international  arena,  domestically,  cyberspace  operations 
must  adhere  to  legal  regimes  concerned  with  law  enforce¬ 
ment,  intelligence  gathering,  and  use  of  military'  force. 
Issues  germane  to  cyberspace  operations  include  home¬ 
land  defense  and  posse  eomitatus;  right  to  privacy,  eaves¬ 
dropping,  and  the  Foreign  Intelligence  Sur\'eillance  Acd; 
and  the  right  of  self-defense  under  Article  51  of  the  United 
Nations  charter. 

With  regard  to  the  inherent  right  of  self-defense,  of 
particular  interest  is  the  question  of  when  a  cyber  attack 
becomes  an  act  of  military  aggression  as  opposed  to  espio¬ 
nage.  Certainly,  there  have  been  large-scale  cross-border 
cyberspace  intrusions  (e.g.,  Estonia  and  Georgia),  but  in 
those  cases  neither  the  United  Nations  nor  the  North  Atlantic 
Treaty  Organization  moved  to  declare  the  event  an  act  of 
military  aggression.  A  Schmitt  Analysis  yields  two  factors 
making  such  a  declaration  problematic:  presumptive  legiti¬ 
macy  and  responsibility,  which  get  to  the  issue  of  attribu¬ 
tion.*^  Presumptive  legitimacy  holds  that  "State  actors  have 
a  monopoly  on  the  legitimate  use  of  kinetic  force,  while  other 
non -kinetic  actions — attacks  through  or  in  cyberspace — arc 
often  permissible  in  a  wider  set  of  circumstances:  actions 
that  have  not  been  the  sole  province  of  nation-states  arc 
less  likely  to  be  viewed  as  military.'’  Also,  “if  a  state  takes 
visible  rcvsponsibility  for  any  destnietivc  act,  it  is  more  likely 
to  be  characterized  as  a  traditional  military  operation. 
Therefore,  this  ambiguity  makes  it  much  more  difficult  to 
declare  a  cyber  event  an  attack.  As  compared  to  the  other 
operational  domains,  such  grey  areas  in  international! 
law  afford  both  state  and  nonstate  actors  considerable 
cover  to  conduct  wide-ranging  cyberspace  operations  with 
potentially  severe  effects.  However,  if  an  event  were  classi¬ 
fied  as  an  attack,  a  response  by  a  nation-state,  including 
one  that  uses  cyberspace,  would  have  to  adhere  to  the  law 
of  armed  conOiet  tenets  of  military  necessity,  distinction, 
proportionality,  and  chivalry.  In  this  regard,  the  legal 
requirements  for  military  operations  in  cyberspace  are  no 
different  than  operations  in  air,  land,  sea,  and  space. 

Further  regulatory-like  inlluence  is  exercised  in  the  tech¬ 
nical  arena  by  industry  consortiums  and  standai*ds-making 
bodies.  This  complex  of  legal,  regulatory,  and  standards 


13 


structures — while  facilitating  free  enterprise,  respect  for 
privacy,  and  property  rights — creates  inherent  hurdles, 
obstacles,  and  barriers  for  the  conduct  of  cyberspace  opera¬ 
tions.  To  be  sure,  thoughtful  change  is  always  an  option  to 
reduce  complexity  when  it  comes  to  the  conduct  of  cyber¬ 
space  operations,  but  the  most  pragmatic  approach  is  for 
military  practitioners  to  acknowledge  this  complexity,  in¬ 
corporate  it  into  their  plans,  find  ways  to  increase  coopera¬ 
tion  with  others  who  have  interests  in  cyberspace,  and  use 
existing  structures  to  the  best  military  advantage  while 
working  to  implement  positive  change. 

Defending  Cyberspace 

Perhaps  the  most  significant  asymmetric  advantage 
afforded  to  an  adversary  is  derived  from  the  difficulty  of 
defending  a  globally  distributed,  highly  technical  domain. 
Cyberspace  is  comprised  of  literally  hundreds  of  millions  of 
addressable  devices  that  use  both  network  communica¬ 
tions  protocol  stacks  and  computer  software  and  hardware 
stacks.  Add  to  this  the  ubiquity  of  the  electromagnetic 
spectrum,  and  the  immensity  of  the  defensive  task  becomes 
clear.  Report  after  report  of  intrusions  and  growing  attack 
sophistication  provide  irrefutable  evidence  that — at  the 
moment — cyberspace  operations  favors  the  offense. 

The  preceding  analysis  of  cyberspace  characteristics 
reveals  the  multidimensional  nature  of  cyberspace.  Fun¬ 
damentally,  cyberspace  is  a  man-made,  evolving,  and 
technological  domain  firmly  rooted  in  the  scientific  reality 
of  electromagnetics.  It  relies  on  electronic  devices,  includ¬ 
ing  communications  switches  and  computer  processors, 
to  transmit  and  process  modulated  signals.  Cyberspace 
is  not  a  global  commons  but  rather  is  owned,  although 
the  standards  which  underpin  its  technological  fabric  are 
largely  a  cooperative  enterprise.  In  addition,  cyberspace  is 
based  on  an  architecture  designed  for  efficient  and  resilient 
data  exchange.  These  three  factors — commercial  electron¬ 
ics,  ownership,  and  ease  of  data  exchange — have  given  rise 
to  a  situation  wherein  both  access  to  the  domain  and  ac¬ 
quisition  of  sophisticated  data  manipulation  tools  are  inex¬ 
pensive.  Skilled  practitioners  can  use  access  and  tools 
to  great  operational  effect,  given  the  speed  and  anonymity 
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at  which  events  occur  under  the  cover  of  a  complex  maze 
of  international  and  domestic  legal,  regulatoiy,  and  stan¬ 
dards  frameworks.  Given  that  cyberspace  operations  currently 
favor  the  offense,  cyberspace,  properly  used,  can  deliver  an 
asymmetric  advantage  to  both  state  and  nonstatc  actors.  For 
nation-states,  cyberspace  operations  promise  to  be  another 
powerful  component  of  Joint  warfare;  however,  the  armed 
forces  must  move  out  to  achieve  domain  mastery  to  make  the 
promise  a  reality. 

Cyberspace  is  an  enabler  of  globalization;  rapid  techno¬ 
logical  innovation;  and  faster  decision  making,  product 
development,  and  service-delivery  cycles.^ ^  These  factors 
all  serve  to  shift  and  undermine  the  status  quo  not  only  in 
business  but  also  in  government  policy  making  and  social 
discourse.  If  an  organization  is  to  prosper,  premiums  must 
be  placed  on  knowledge  about  the  environment  and  the 
speed  with  which  organizations  can  act  to  take  advantage 
of  opportunities  or  deal  with  challenges.  Richard  A.  D'Aveni 
describes  this  situation  as  hypercompetition.  Hypcrcoinpetition 
is  "an  environment  characterized  by  intense  and  rapid  com¬ 
petitive  moves,  in  which  competitors  must  move  quickly  to 
build  new  advantages  and  (simultaneously]  erode  the  advan¬ 
tages  of  their  rivals. Organizational  survival  hinges  on  the 
capacity  for  strategic  and  operational  flexibility,  leadership 
agility,  and  the  ability  to  employ  aggressive  strategies  to 
radically  shift  the  status  quo  and  destroy  competitor  advan¬ 
tage.  Experimentation,  rapid  learning,  and  adaptation  are 
prized,  while  penalties  can  be  severe  for  slow  and  inappro¬ 
priate  responses. 

Hypercompetition  is  a  strong  metaphor  for  the  funda¬ 
mental  task  of  the  armed  forces — fighting  and  winning  the 
nation’s  wars  in  a  VUCA  operational  environment.  From  a 
war-fighting  standpoint,  hypercompetition  evokes  concepts, 
like  full-spectrum  dominance,  the  Clausewitzian  Trinity, 
and  operational  art,  that  conceive  of  warfare  as  an  intensely 
competitive  struggle  against  cunning  adversaries  where 
measure  is  met  by  countermeasure  in  a  lethal  struggle 
to  gain  supremacy, In  a  similar  manner,  cyberspace 
operations  exemplify  the  hypereompetitive  metaphor  as 
these  operations  are  conducted  in  the  very  domain  that 
drives  the  hypereompetitive  reality.  The  armed  forces 
are  de  facto  competitors  in  this  domain  in  much  the 
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same  way  as  commercial  industry  is,  with  the  additional 
component  of  combat. 

In  cyberspace,  competition  moves  at  a  rapid  rate,  in  part 
due  to  the  speed  at  which  technology  changes.  Therefore, 
any  competitive  advantage  achieved  in  cyberspace  is  tenuous 
and  transient,  and  military  superiority  must  be  viewed  as 
temporary,  local,  and  continually  at  risk.  Just  as  success¬ 
ful  business  organizations  must  have  the  ability  to  quickly 
conceive  of  and  employ  technological  solutions  to  chal¬ 
lenges  arising  in  and  from  the  domain,  so  must  the  armed 
forces,  especially  in  terms  of  cyber  defense.  Success  requires 
the  armed  forces  to  effectively  deal  with  rapid  change  and 
complexity  in  order  to  achieve  efficacy  in  support  of  national 
security  priorities — requirements  that  are  especially  perti¬ 
nent  for  cyberspace  operations. 


Command  and  Control  and 
the  Cyberspace  Domain 

Command  and  control  is  often  misunderstood  and  not 
surprisingly  so.  Surveys  of  C2  literature  reveal  a  wide  variety 
of  definitions,  approaches,  and  models.  In  order  to  provide  a 
common  intellectual  framework  for  understanding  the  C2 
models  to  be  discussed,  this  section  describes  how  the  term 
command  and  control  emerged.  In  addition,  particular  atten¬ 
tion  will  be  paid  to  the  match  of  organizational  form  to  C2.  Of 
central  importance  to  this  discussion  is  W.  Ross  Ashby’s  law 
of  requisite  variety,  which  states  that  an  organization’s  inter¬ 
nal  regulatory  mechanisms  must  be  as  diverse  as  the  envi¬ 
ronment  within  which  it  is  embedded. Building  on  Ashby, 
Henk  Volberda  further  asserts  that  the  ability  to  deal  with  a 
hypercompetitivc  threat  is  directly  related  to  how  well  an 
organization  is  structured  internally  to  match  the  environ¬ 
ment.^^  An  organization  with  variety  is  capable  of  adapting 
appropriately  to  its  environment  or  adapting  its  environment 
to  the  benefit  of  the  organization.  In  the  VUCA  environment, 
careful  consideration  is  needed  to  ascertain  which  organi¬ 
zational  model  will  perform  best,  as  the  choice  will  directly 
affect  the  C2  method  deployed  to  support  the  organization’s 
mission.  Choices  must  be  made  between  stability  and 
flexibility,  specialization  and  generalization,  and  centralization 
and  decentralization.^^  Too  much  internal  complexity,  and 
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opcratini^  costs  go  up.  Too  little,  and  the  organization  will  not 
produce  the  requisite  variety  needed  to  sunivc.  It  is  clear 
that  the  correct  choice  of  organizational  form  is  critical  to 
achieving  cyberspace  superiority. 

Alter  establishing  a  common  understanding  of  C2.  three 
main  models  for  C2,  with  important  variants,  arc  presented: 
(1)  the  historical-traditional  model  (which  includes  the  cur¬ 
rent  DOD  approach  to  cyberspace  C2),  (2)  the  cybernetic- 
systems  model,  and  (3)  the  cognitive-psychological  model. 
These  models  are  also  linked  to  the  positive  and  negative 
characteristics  of  the  hierarchical,  heterarchical,  and  hybrid 
organizational  forms.  These  three  approaches  are  then 
vetted  in  terms  of  enduring  C2  criteria,  with  particular  focus 
on  C2  organization  and  authorities.  A  recommendation  is 
then  made  on  a  cyberspace  C2  approach  and  what  actions 
must  be  taken  to  implement  it. 


Historical-Traditional  Model 

The  roots  of  the  modern  understanding  of  C2  can  be 
traced  to  the  industrial  revolution  with  its  requirements  for 
the  direction  of  large  organizations  engaged  in  complex 
niciss-production  processes.  fTom  this  viewpoint.  C2  is 
synonymous  with  the  hierarchic  organizational  form  and 
the  emergence  of  the  professional  bureaucracy.  Early  orga¬ 
nizational  pioneers  such  as  Mtix  Weber.  Frederick  Taylor, 
and  Frank  and  Lillian  Gilbreth  studied  bureaucratic  orga¬ 
nization.  work  design,  work  measurement,  standardization, 
and  production  control  in  order  to  best  take  advantage  of 
the  division  of  labor  and  specialization  of  tasks,  thereby 
increasing  produc'tion  output  and  efficiency.  Alfred  P.  Sloan 
is  credited  with  establishing  the  modern  hierarchical  form 
of  industrial  organization  with  his  divisional  structure. 
This  structure  emphasizes  strict  hierarchical  command 
chains,  c-entralized  finance  and  planning,  cross-divivSional 
integration  at  the  corporate  level,  and  tight  control  of  and 
reporting  on  highly  prescribed  production  activities.  This 
basic  constmetion  endures  not  only  in  the  business  arena 
but  also  in  the  organization  of  the  armed  forces,  as  seen  in 
the  plan  employed  to  mobilize  for  and  conduct  the  Second 
World  War,  the  Defense  Reorganization  Act  of  1947,  and  the 
Goldwatcr-Nichols  Act  of  1987.^^ 
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From  a  technical  perspective,  the  development  of  C2  as 
an  organizational  function  reached  new  heights  during  the 
Second  World  War.  The  challenges  brought  on  by  the  war 
resulted  in  the  intensified  development  and  use  of  mathe¬ 
matical  methods  to  work  on  complex  military  C2  problems 
such  as  antiair  defense,  d3mamic  ballistic-firing  solutions, 
large-scale  logistics  movements,  and  production  and  resource 
allocation  decisions.  During  this  period  and  shortly  there¬ 
after,  statistical  methods,  operations  research,  linear  pro¬ 
gramming,  control  theory,  and  systems  analysis  were  applied 
to  these  problems  on  a  nearly  wholesale  basis.  In  addition, 
the  use  of  the  first  computers  allowed  mathematicians  to 
solve  more  and  more  complex  problems  in  less  time.  With 
the  aid  of  computers,  advanced  computational  methods 
were  developed  for  simulation  and  forecasting  of  future  results 
and  to  increase  the  efficiency  of  a  hierarchical  organiza¬ 
tion’s  processes.  The  increasing  use  of  computers  to  actually 
perform  organizational  control  functions  contributed  to  the 
identification  of  C2  as  inherently  technology-enabled, 
thereby  serving  to  blur  the  distinction  between  the  pur¬ 
poses  of  command  and  control.  In  essence,  the  two  were 
viewed  as  synonymous.  Further  evolution  of  C2  occurred 
during  the  Cold  War  as  increasingly  sophisticated  and  com¬ 
prehensive  computerized  command  and  control  systems 
were  developed. 

The  Cold  War  ushered  in  yet  another  era  of  scientific 
development,  given  the  need  to  ensure  positive  control  of 
the  destructive  power  of  nuclear  weapons  and  their  delivery 
platforms,  inform  procurement  decisions  for  increasingly 
complex  weapon  systems,  manage  the  development  and 
production  of  these  systems,  model  and  simulate  nuclear 
warfare  scenarios,  and  direct  the  actual  conflict.  With  regard 
to  nuclear  conflict,  it  was  quickly  recognized  that  nuclear¬ 
armed  jet  bombers,  and  soon  thereafter  ballistic  missiles, 
dramatically  reduced  the  time  to  detect  and  intercept  Soviet 
equivalents.  This  drove  the  need  for  a  responsive  and  reliable 
C2  system,  one  based  on  state-of-the-art  communications 
and  computing  technology.  Due  to  the  consequences  of 
nuclear  conflict  and  the  requirement  to  retain  tight  control 
of  its  inherent  destructive  power,  the  function  of  command — 
the  authority  to  direct  military  forces — was  seen  as  inextri¬ 
cably  tied  to  the  organizational,  procedural,  and  technical 
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apparatus  that  allowed  command  to  be  exercised.  To  address 
this  situation,  the  military  designed  and  implemented  a  tightly 
coupled  C2  system  composed  of  computerized  command, 
control,  and  communications  systems  and  highly  specified 
operational  pro<'edures  that  were  in  turn  reinforced  by  rigor¬ 
ous  training,  exercise,  and  inspection  standards.  This  highly 
prescribed  and  vertically  integrated  C2  system  resulted  in 
positive  weapons  control,  assured  receipt  of  orders,  and  high 
launch  probability  from  the  order  to  launch  at  the  presidential 
level  to  the  turning  of  keys  in  missile  silos. 

Historical-traditional  C2  is  virtually  synonymous  with 
the  hierarchical  organizational  form,  which  has  performed 
well  during  the  industrial  age  and  for  modern  government 
bureaucracies  (fig.  2).  Hierarchical  organizations  have  a 
pyramidal  structure  and  are  characterized  by  specified 
superior-subordinate  chains  of  command,  specialization 
by  function,  uniform  policies  covering  rights  and  duties, 
standardized  procedures  for  each  job,  a  career  based  on 
promotions  for  technical  competence,  impersonal  rela¬ 
tions,  and  all  coordination  being  done  from  a  level  above 
the  work  being  coordinated.^^  They  reduce  transaction 
costs  by  increasing  scale  and  by  placing  control  of  resources 
into  the  hands  of  top-level  managers  and  are  well  matched 
to  stable,  predictable  environments  and  large-scale  produc¬ 
tion.  Hierarchies  take  advantage  of  the  division  of  labor  and 
economies  of  scale  for  known,  structured  problems  where 
there  is  less  of  a  requirement  to  coordinate  and  share  infor¬ 
mation  across  functional  lines  of  authority.  Position,  rank, 
and  experience  are  of  paramount  importance  with  regard  to 
power  relationships,  decision-making  authority,  and  con¬ 
trol  of  resources.  Power  and  decision-making  authority  arc 
concentrated  at  the  top  of  the  hierarchy  and  decrease  as 
one  moves  to  the  lower  levels  of  the  organization. 

Hierarchies  also  create  “stovepipes,”  which  are  vertical, 
tightly  coupled  component  organizations  that  are  opti¬ 
mized  for  narrowly  focused  functions  (e.g.,  intelligence, 
logistics,  maintenance,  etc.).  The  systems  that  support  hier¬ 
archies  are  built  and  controlled  by  these  stovepipes,  making 
interoperability  difficult  to  achieve.  This,  in  turn,  driv^es  the 
need  for  systematic  coordination  and  integration  if  the  orga¬ 
nization  is  to  achieve  its  overall  purpose.  Information  flow 
in  a  hierarchy  is  necessarily  aggregated  and  filtered  as  it 
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National  Command  Authority 


•Trams  and  equips 


Figure  2.  National  Command  Authority.  (Adapted  from  JP-1,  Doctrine 
for  the  Armed  Forces  of  the  United  States,  14  May  2007,  II-5.) 


moves  up  the  organization.  Lower-level  elements  therefore 
have  the  most  detailed  local  knowledge  of  the  environ¬ 
ment,  whereas  leaders  at  the  top  of  the  hierarchy  have  a 
broader  picture  of  the  global  environment  in  which  the 
organization  operates.  Courses  of  action  are  constructed 
globally  at  the  highest  command  level  and  are  progres¬ 
sively  distilled  down  at  each  subordinate  layer  of  com¬ 
mand.  Information  flows  within  a  hierarchy  are  largely 
confined  to  the  stovepipes  that  created  the  information. 
There  is  little  incentive  to  share  information  given  that  it 
is  a  source  of  knowledge — and  therefore  power — within  the 
organization.  Given  the  time  it  takes  for  information  to 
flow  from  the  bottom  of  the  organization  to  the  top,  decision¬ 
making  time  horizons  and  perspectives  are  different  between 
levels,  yielding  an  asymmetry  of  decision-making  focus.  For 
the  top  of  the  pyramid,  the  longer  time  horizon  and  the  higher 
position  in  the  hierarchy  result  in  decisions  that  are  larger  in 
scope  and  longer  in  term. 

The  historical-traditional  military  C2  model  is  closely  tied  to 
the  hierarchical  form.  However,  despite  its  success,  the  effec¬ 
tiveness  of  the  hierarchical  form  is  challenged  by  environmen¬ 
tal  complexity,  accelerating  change,  and  hj^ercompetition. 
Hierarchies  are  slow  to  respond  to  environmental  changes  in 
part  due  to  the  restricted,  up-and-down  flow  of  information. 
Although  hierarchies  can  sometimes  react  quickly  to  narrowly 
defined  crises,  they  can  lack  the  requisite  variety  to  respond 
appropriately.  Horizontal  communication  is  hampered,  and 
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functional  loyeilties  of  stovepipes  inhibit  communication, 
problem  solving,  and  coordination.  The  focus  on  efficiency 
means  functional  components  can  make  decisions  that  benefit 
them  rather  than  the  organization  as  a  whole.  Interests  be¬ 
come  entrenched,  and  the  organization  as  a  whole  resists 
change.  Experience  and  position  can  be  more  prized  than 
knowledge,  leading  to  poor  decisions  or  lack  of  acceptance  of 
new  ideas. 

Fast-forward  to  today,  and  it  is  readily  apparent  that  the 
definition  of  C2  in  JP  1-02  is  at  least  partially  a  product  of 
this  industrial-age,  nuclear-era  understanding  of  the  con¬ 
cept.  The  DOD,  for  example,  defines  command  and  cotitrol 
as  “the  exercise  of  authority  and  direction  by  a  properly 
designated  commander  over  assigned  and  attached  forces 
in  the  accomplishment  of  the  mission.  Command  and  con¬ 
trol  functions  are  performed  through  an  arrangement  of 
personnel,  equipment,  communications,  facilities,  and  pro¬ 
cedures  employed  by  a  commander  in  planning,  directing, 
coordinating,  and  controlling  forces  and  operations  in  the 
accomplishment  of  the  mission. Rooted  in  this  definition 
are  the  traditional-historical  notions  of  hierarchy,  authority, 
and  management  of  scale,  complexity,  and  force.  This  under¬ 
standing  results  in  a  distinct  military  approach  to  C2  that 
tightly  couples  its  functions  for  the  purpose  of  controlling 
military  force  in  a  hierarchical  organization. 

With  regard  to  current  DOD  organization  for  cyber¬ 
space  C2,  at  the  top  of  the  hierarchy  is  USSTRATCOM. 
USSTRATCOM  is  tasked,  via  the  Unified  Convnand  Plan 
(L/CP),  to  defend  the  armed  forces’  global  information 
grid,  the  military-only  portion  of  cyberspace.  This  means 
that  USSTRATCOM  has  the  combatant  command  authority 
to  operate  and  defend  the  GIG.  Indeed,  USSTRATCOM 
states  that  pari  of  its  mission  is  “to  ensure  US  freedom  of 
action  in  space  and  cyberspace. To  accomplish  this  mis¬ 
sion,  it  established  two  subordinate  commands — the  Joint 
Functional  Component  Command  for  Network  Warfare  and 
Joint  Task  Force-Global  Network  Operations.  The  JFCC-NW 
is  responsible  for  coordinating  and  executing  offensive  opera¬ 
tions  enabled  by  the  National  Security  Agency’s  (NSA)  exploit¬ 
ative  cyberspace  operations.  The  JTF-GNO  executes  its  mis¬ 
sion  to  operate  and  defend  military  cyberspace  through  the 
issuance  of  various  operational  and  defensive  orders  to 
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subordinate  commands.  These  orders  direct  GIG  configu¬ 
ration  changes,  defensive  measures,  and  reporting  require¬ 
ments.  Until  recently,  these  two  organizations,  while 
reporting  to  USSTRATCOM,  were  separate.  However, 
understanding  the  lack  of  synergy  and  C2  difficulties 
encountered  by  “splitting”  offense  and  defense,  the  DOD 
acted  to  remedy  this  with  the  November  2008  secretary  of 
defense  memo  that  placed  JTF-GNO  under  the  operational 
control  of  JFCC-NW.^^  Interestingly,  the  commanders  of 
both  the  JTF-GNO  and  JFCC-NW  maintain  their  current 
dual-hatted  roles:  the  three-star  commander  of  JTF-GNO 
is  also  the  Defense  Information  Systems  Agency  com¬ 
mander,  and  the  three-star  commander  of  the  NSA  is  also 
the  JFCC-NW  commander. 

Within  the  USAF,  the  top-level  organization  for  cyber¬ 
space  now  resides  with  Twenty-fourth  Air  Force  under  Air 
Force  Space  Command.  Through  Twenty-fourth  Air  Force, 
the  USAF  operates  and  defends  its  portion  of  cyberspace 
through  its  Air  Force  Network  Operations  command.  It  is 
from  this  organization  that  all  operational  and  defensive 
actions  are  directed  for  Air  Force  cyberspace.  AFNETOPS 
executes  C2  of  cyberspace  through  two  Network  Opera¬ 
tions  and  Security  Centers  (NOSC).  Each  NOSC  is  assigned 
certain  Air  Force  bases  and  is  fully  responsible  for  operat¬ 
ing  and  defending  the  cyberspace  that  affects  these  bases. 
Agreements  between  the  NOSCs  and  base  communications 
squadron  delineate  responsibilities  and  help  to  ensure  that 
the  two  organizations  do  not  duplicate  work.  The  implica¬ 
tions  for  this  arrangement  are  that  wing  commanders  have 
lost  control  of  the  base-level  computer  network  and  have  no 
say  in  the  decisions  regarding  its  operations  and  defense. 
Rather,  these  decisions  are  now  made  at  AFNETOPS  or  the 
NOSCs.  Another  challenge  arises  when  a  squadron  deploys 
to  another  combat  command,  thereby  falling  within  that 
COCOM’s  authority. 

Figure  3  shows  the  dual  chain  of  command  a  communi¬ 
cations  squadron  operates  under  in  a  deployed,  wartime 
environment.  Unlike  the  air,  land,  sea,  and  space  domains, 
there  is  no  discussion  of  combatant,  operational,  or  tactical 
command  as  one  expects  regarding  a  domain  of  warfare. 
Instead,  there  are  two  lines  of  command  authority  directing 
the  cyberspace  activities  of  a  base  communications  squadron 
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Figure  3.  Current  DOD  cyberspace  C2 


in  a  deployed  environment.  This  arrangement  not  only 
causes  confusion  and  duplication  of  effort  but  also  violates 
the  principle  of  warfare  known  as  unity  of  command.  Com¬ 
pounding  the  confusion  is  the  fact  that  the  Air  Force  NOSCs, 
which  direct  all  activity  on  AF  networks,  are  outside  of  the 
combatant  command’s  chain  of  command.  Further,  the 
COCOM  is  outside  the  functional  line  regarding  how  the  Air 
Force  operates,  trains,  and  equips  its  forces.  In  the  final 
analysis,  the  DOD,  services,  and  COCOMs  have  established 
a  traditional- hierarchical  C2  structure  that  undermines 
unity  of  command,  conflates  the  roles  of  the  services  and 
combatant  commands,  and — most  critically — hamstrings 
the  armed  forces’  ability  to  rapidly  adapt  to  events  and  in¬ 
novations  arising  in  the  cyberspace  domain.  This  situation 
unnecessarily  constrains  freedom  of  action  and  prevents 
the  agility  needed  to  successfully  operate  in  the  domain. 

In  order  to  exercise  cyberspace  C2,  legal  authority  must 
be  assigned  to  a  commander.  Under  the  current  cyberspace 
C2  eonstruet,  the  authorities  of  the  COCOMs  and  services 
overlap  and  are  poorly  defined,  further  complicating  C2. 
The  new  UCP  attempts  to  clarify  some  of  these  authority 
issues  by  clearly  breaking  out  cyberspace  operations  as  a 
new  responsibility  for  the  USSTRATCOM  commander.  Spe¬ 
cifically,  the  new  UCP  states  that 
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USSTRATCOM  is  responsible  for  synchronizing  planning  for  cyber¬ 
space  operations,  and  will  do  so  in  coordination  with  other  combatant 

commands,  the  Services,  and  as  directed,  appropriate  U.S.  govern¬ 
ment  agencies.  USSTRATCOM  s  specific  responsibilities  include; 

(a)  Directing  Global  Information  Grid  operations  and  defense. 

(b)  Planning  against  designated  cyberspace  threats. 

(c)  Coordinating  with  other  combatant  commands  and  appropriate 
U.S.  government  agencies  prior  to  the  generation  of  cyberspace 
effects  that  cross  areas  of  responsibility. 

(d)  Providing  military  representation  to  U.S.  national  agencies,  U.S. 
commercial  entities,  and  international  agencies  for  matters  related 
to  cyberspace,  as  directed. 

(e)  Advocating  for  cyberspace  capabilities. 

(0  Integrating  theater  security  cooperation  activities,  deployments, 
and  capabilities  that  support  cyberspace  operations,  in  coordina¬ 
tion  with  the  geographic  combatant  commanders,  and  making 
priority  recommendations  to  the  Secretary. 

(g)  Planning  OPE  [operational  preparation  of  the  environment],  and 
as  directed,  executing  OPE  or  synchronizing  execution  of  OPE  in 
coordination  with  the  geographic  combatant  commanders. 

(h)  Executing  cyberspace  operations,  as  directed. 


At  first  glance,  this  appears  to  show  that  USSTRATCOM  is 
in  charge  of  the  operation  and  defense  of  cyberspace,  or  at 
least  the  GIG.  However,  in  lengthy  joint  staff-tank  sessions, 
a  new  phrase  was  defined,  and  it  becomes  a  critical  point  for 
this  new  UCP.  Specifically,  the  tank  defined  the  phrase  “syn¬ 
chronize  planning”  to  mean  “Combatant  Commanders 
charged  with  synchronizing  planning  lead  a  global  collabora¬ 
tive  planning  process  that  includes  other  Combatant  Com¬ 
manders,  Services,  Combat  Support  Agencies,  and  applicable 
Defense  agencies  and  Field  Activities  in  support  of  a  desig¬ 
nated  global  mission  or  campaign  plan.  The  phrase  ‘synchro¬ 
nizing  planning’  pertains  specifically  to  planning  efforts  only 
and  does  not,  by  itself,  convey  authority  to  execute  opera¬ 
tions  or  direct  execution  of  operations. 

This  shows  that  disagreement  remains  between 
USSTRATCOM,  the  other  combatant  commands,  and  the 
services  regarding  overall  authority  for  conducting  cyber¬ 
space  operations.  The  issue  at  hand  is  whether  USSTRATCOM 
ought  to  have  the  authority  to  direct  cyberspace  operations 
within  another  COCOM’s  area  of  responsibility.  Although 
the  2008  UCP  attempts  to  resolve  some  of  this  disagree- 
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ment  by  specifieally  mentioning  eyberspaee  and  assigning 
the  mission  to  USSTRATCOM,  it  stops  short  of  assigning 
USSTRATCOM  the  full  authority  to  eonduct  cyberspace 
operations  across  the  globe  by  the  inclusion  of  the  phrase 
"synchronize  planning.”  In  effect,  this  phrase  allows  the 
other  combatant  commands  and  senices  to  disregard 
USSTRATCOM  directives  with  which  they  disagree.  There 
remains  no  clear  authority  for  cyberspace  C2. 

This  attempt  to  bring  cyberspace  operations  under  the 
command  of  a  single  COCOM  will  also  cause  other  issues. 
For  example,  cyberspace  activities  such  as  network  main¬ 
tenance  fall  under  the  purview  of  the  respective  senice.  not 
a  combatant  command. However,  in  a  recent  memoran¬ 
dum,  the  secretary  of  defense  recently  approved  a  defini¬ 
tion  for  cyberspace  operations  as  "the  employment  of  cyber 
capabilities  where  the  primary  purpose  is  to  achieve  militaty 
objectives  or  effects  in  or  through  cyberspace.  Such  opera¬ 
tions  include  computer  network  operations  and  acti\1ties  to 
operate  and  defend  the  Global  Information  Grid."^^^’  The 
memorandum  goes  on  to  state  that  (1)  the  term  cyberspace 
operations  is  eonsistent  with  the  language  used  in  the 
National  Military  Strategy  for  Cyberspace  Operations, 
presidential  directives,  and  the  2008  Unijied  Command 
Plan:  (2)  the  methodology  used  for  delining  cyberspace 
operations  is  consistent  with  other  Joint  operational  defi¬ 
nitions:  and  (3)  cyberspace  operations  should  encompass 
current  computer  network  operations  and  activities  to 
operate  and  defend  the  Global  Information  Grid.^^ 

The  first  two  points  are  significant  because  they  show  an 
attempt  to  forestall  any  further  complaints  or  objections 
about  this  definition  by  declaring  eyberspaee  operations  to 
be  fully  consistent  with  all  salient  documentation  currently 
published.  The  second  point  establishes  cyberspace  opera¬ 
tions  as  an  official  DOD  definition,  to  be  incorporated  into 
JP  1-02.  However,  the  third  point  is  significant  beeause  it 
states  that  network  attack  and  network  defense  fall  under 
eyberspaee  operations  and  include  activities  to  "operate 
and  defend  the  GIG.”  When  viewed  in  light  of  the  2008  UCP, 
it  appears  that  operations  and  maintenance  activities,  legcilly 
a  service  responsibility,  are  now  assigned  to  a  COCOM.  This 
creates  a  situation  wherein  two  separate  entities — 
USSTRATCOM  and  the  services — could  validly  claim  the 
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authority  to  direct  military  cyberspace  operations  in  accor¬ 
dance  with  Title  10  of  the  US  Code  and  DOD  guidance. 
Some  would  argue  that  USSTRATCOM  can  avoid  this  issue 
by  labeling  all  its  cyberspace  directives  as  defensive  in  nature, 
which  is  well  within  their  purview,  versus  operations  and 
maintenance,  the  purview  of  the  services.  However,  it  is 
inevitable  that  the  services  will  protest  this  situation  as  an 
encroachment  on  their  congressionally  mandated  Title  10 
authorities  to  organize,  train,  and  equip  forces. 

The  current  arrangement  for  cyberspace  C2  mixes  authori¬ 
ties  and,  as  such,  will  continue  to  constrain  the  ability  of  the 
armed  forces  to  conduct  responsive  cyberspace  operations. 
The  issues  associated  with  USSTRATCOM,  other  combatant 
commands,  and  service  prerogatives  must  be  dealt  with  and 
call  for  a  complete  rethinking  of  the  DOD’s  approach  to  cyber¬ 
space  C2. 

We  argue  that  such  an  understanding  of  C2  is  inappro¬ 
priately  restrictive  for  the  cyberspace  domain.  What  is 
needed  is  an  approach  to  C2  that  allows  more  flexibility  to 
conceptualize  and  match  the  fundamental  purpose  of  C2  to 
the  environment  in  which  it  is  exercised.  Toward  this  end, 
we  follow  Berndt  Bremer  and  George  Orr,  who  view  the  pur¬ 
pose  of  C2  as  the  direction  and  coordination  of  operations 
to  produce  desired  effects  according  to  the  commander’s 
intent  through  the  positioning  of  forces  at  the  time  and 
place  they  are  needed.^®  From  this  perspective,  effective 
command  seeks  to  gain  competitive  advantage  by  control¬ 
ling  the  military  power  distribution.^^  Control  is  achieved 
by  gathering  information  about  the  operational  environ¬ 
ment,  synthesizing  the  information  to  understand  what  actions 
must  be  taken,  and  translating  that  understanding  into 
orders  and  direction  that  are  executed  through  one’s 
forces."*®  This  understanding  of  C2  emphasizes  goal,  adver¬ 
sary  (environment),  and  process  rather  than  specification 
of  authority,  command  chains,  and  organizational  struc¬ 
ture  which  unnecessarily  limit — perhaps  catastrophically — 
the  action  required  of  the  C2  system.  Given  this  under¬ 
standing,  we  examine  other  alternatives  for  cyberspace  C2 
and  commensurate  organizational  forms. 
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Systems  Theory  and  the 
Cybernetic-Systems  Model 

First  articulated  by  biologist  Ludwig  von  Bertalanffy  in 
his  book  General  Systems  Theory,  systems  theory  offers 
principles  and  methods  with  which  to  study  the  interactions, 
relationships,  and  structure  of  any  set  of  interacting  entities 
(a  system). Systems  theory  therefore  takes  a  holistic  per¬ 
spective  instead  of  a  reductionist  one:  the  behavior  of  a  system 
is  understood  from  the  interactions  of  its  parts  rather  than  a 
detailed  understanding  of  each  of  its  parts.  It  is  directed  to¬ 
ward  the  analysis  of  "any  group  of  objects  that  work  in  con¬ 
cert  to  produce  some  result.  This  could  be  a  single  organism, 
any  organization  or  society,  or  any  electro-mcchanieal  or  in¬ 
formational  artifact. Based  on  Bertalanfiy's  study  of  bio¬ 
logic  organisms,  two  basic  principles  characterize  systems 
theory.  "First,  all  phenomena  can  be  viewed  as  a  web  of 
relationships  among  elements,  or  a  system.  Second,  all 
systems,  whether  electrical,  biological,  or  social,  have 
common  patterns,  behaviors,  and  properties  that  can  be 
understood  and  used  to  develop  greater  insight  into  the 
behavior  of  complex  phenomena. Systems  theory  also 
endeavors  to  understand  the  interactions,  processes,  rela¬ 
tionships,  and  macro  behavior  of  the  interdependent  parts 
as  a  whole.  Especially  important  are  the  complexity  of  the 
relationship  of  systems  to  their  environments  and  the 
ability  of  systems  to  adjust  to  changes  in  the  environ¬ 
ment.  Systems  theory  includes  the  following  key  traits: 

•  A  system  is  a  dynamic,  complex,  and  interdependent 
whole,  interacting  as  a  structured  functional  unit. 

•  A  system  is  holistic,  exhibiting  emergent  properties  not 
possible  to  detect  by  analysis  of  individual  parts. 

•  A  system  is  a  community  situated  within  an  environment. 

•  Energy,  materiel,  and  information  flow  among  the  dif¬ 
ferent  elements  that  compose  the  system. 

•  The  elements  of  the  system  are  differentiated  and  per¬ 
form  specialized  functions. 
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•  Energy,  materiel,  and  information  flow  from  and  to  the 
surrounding  environment  via  semipermeable  mem¬ 
branes  or  boundaries. 

•  Energy,  materiel ,  and  information  are  transformed  into  out¬ 
puts  through  processes  by  which  the  goals  are  achieved, 

•  Systems  are  often  composed  of  entities  seeking  equi¬ 
librium  but  can  exhibit  other  types  of  behavior  (e.g., 
chaotic,  oscillating), 

•  Systems  are  regulated  through  feedback. 

•  Systems  can  comprise  parts  of  larger  systems. 

•  A  system  is  goal  seeking,  meaning  that  systemic  inter¬ 
action  must  result  in  some  goal  or  final  state. 

•  Systems  exhibit  equifinality,  alternative  ways  of  attain¬ 
ing  the  same  objectives  (convergence),  and  multifinality, 
attaining  alternative  objectives  from  the  same  inputs 
(divergence), 

The  cybernetic-system  model  is  the  dominant  C2  para¬ 
digm  for  nearly  all  researchers  and  systems  builders  and 
either  explicitly  or  implicitly  informs  all  C2  models  (see  fig. 
4).  A  cybernetic  system  is  composed  of  three  fundamental 
components:  (1)  sensors  that  accept  input  from  the  envi¬ 
ronment,  (2)  processors  that  accept  the  input  and  trans¬ 
form  it,  and  (3)  output  mechanisms  that  take  the  processed 
information  and  use  it  to  change  the  behavior  of  the  sys¬ 
tem.  The  cybernetic  aspect  of  military  operations  is  readily 
apparent  given  that  these  operations  are  a  process  by  which 
a  commander  (sensor  and  processor)  directs  forces  (people, 
processes/organizations,  and  technology  organized  into  a 
system  to  produce  output)  to  achieve  comparative  advan¬ 
tage  over  an  adversary  (interaction  with  the  environment) 
through  maneuver  and  the  application  of  firepower  (output 
and  feedback).  The  science  of  cybernetics  observes  internal  and 
external  interactions  “guided  by  the  principle  that  numerous 
different  types  of  systems  can  be  studied  according  to  principles 
of  feedback,  control,  and  communications,”'^^  Also  key  to  un¬ 
derstanding  the  concept  of  cybernetics  is  the  idea  of  self-regu¬ 
lation.  When  a  system  senses  a  change  in  the  environment, 
that  information  is  used  to  adjust  the  behavior  according  to 
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tlie  goal  of  Uie  system.  The  system  then  monitors  the  en\aron- 
ment  to  ascertain  if  either  the  internal  or  external  change  has 
successfully  aligned  with  the  system  s  goal. 


Cybernetic  Model 

The  Basic  Cybernetic  Model 
(sources:  Wiener,  1 948;  von  Bertalanffy,  1 968) 


Stimulus 

r  ^ 

Receptor 

Message 

Control 

Message 

r  ^ 
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^  Apparatus^ 

tnector 

Feedback 

Key  Characteristics  of  the  Cybernetic  Model: 

-  Self-regulation/self-adaptation 

-  Feedback  loop 

-  Control 

-  Information 
(source:  Wiener,  1948) 


EMERGED  OUT  OF  WWII  AND  IS  THE  FOUNDATION 
OF  THE  OVERWHELMING  MAJORITY  OF  C2  MODELS 


Figure  4.  The  Cybernetic  Model.  (Adapted  from  Norbert  Wiener,  Cyber¬ 
netics:  Or  the  Control  and  Communication  in  the  Animal  and  the  Machine 
[Cambridge,  MA:  MIT  Press,  1948];  and  Ludwig  von  Bertalanffy,  General 
Systems  Theory:  Foundations,  Development,  and  Applications  [New 
York:  George  Braziller,  1968].) 


Management  cybernetics  applies  the  principles  of  cyber¬ 
netics  and  systems  theory  to  organizations.  Pioneered  by 
Stafford  Beer  in  1959,  management  cybernetics  examines  the 
problems  of  control  and  decision  making  and  the  development 
of  models  in  terms  of  the  organization’s  goals;  inputs,  trans¬ 
formation  of  inputs,  and  outputs;  regulation,  control,  and 
feedback:  and  capability  to  generate  a  variety  of  responses 
to  environmental  challenges. Beers  Viable  System  Model 
(lig.  5)  is  an  abstracted  cybernetic  description  applicable 
to  any  organization  that  is  a  viable  system  and  capable  of 
autonomy.  Beer  developed  the  Viable  System  Model  as  a  con¬ 
ceptual  tool  for  designing,  implementing,  and  reengineering 
organizations  to  improve  an  organization’s  ability  to  adapt 
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Figure  5.  Viable  System  Model.  (Adapted  from  Stafford  Beer,  Brain  of 
the  Firm  [London:  Penguin  Press,  1972].) 


and  survive  in  its  environment.'^'^  Beers  model  examines 
five  major  elements  that  an  organization  depends  on  to 
achieve  its  purpose:  (1)  operations,  (2)  coordination  between 
elements  in  the  organization,  (3)  aetivity  and  resources  that 
optimize  the  organization  in  relation  to  its  environment,  (4) 
the  organization’s  environment,  and  (5)  normative  rules  and 
regulations.  The  model  then  diagnoses  the  information  flows 
that  tie  all  the  elements  together  in  terms  of  sufficiency  and 
richness.  Multichannel  robustness  is  especially  emphasized 
as  it  allows  the  organization’s  structures  and  processes  to 
work  and  deal  with  changes  in  the  environment.  Control, 
regulation,  and  communication  are  also  optimized  according 
to  what  the  organization  must  do  to  be  successful  in  its  cur¬ 
rent  operations,  for  its  future,  and  in  terms  of  its  long-term 
identity  and  values. 

Models  Derived  from  Complexity  Theory 

The  principles  of  cybernetics  and  systems  theory  have  in 
turn  informed  the  development  of  complexity  theory.  Com¬ 
plexity  theory  is  a  special  application  of  systems  theory, 
founded  on  biological  science  and  the  behavior  of  living 
organisms.  It  can  be  defined  as  “any  system  featuring  a 
large  number  of  interacting  components,  whose  aggregate 
activity  is  nonlinear  and  typically  exhibits  hierarchical 
self-organization  and  evolving  behavior  when  placed  under 
stress  from  its  environment.’’^®  Brom  an  organizational 
standpoint,  complexity  theory  is  used  to  explain  how  orga¬ 
nizations  adapt  and  survive  in  their  environments.'^®  John 
H.  Holland,  a  complex  and  nonlinear  systems  pioneer, 
cites  such  characteristics  as  self-organization,  emergent 
behavior,  dispersed  control,  and  adaptability  as  hallmarks 
of  a  complex  organization.  He  describes  complex  adaptive 
systems  as  having  the  following  qualities: 

•  Many  agents  acting  in  parallel  in  an  environment  produced 
by  their  interactions  with  other  agents  in  the  system. 

•  Because  the  agent  is  constantly  acting  and  reacting  to 
the  other  agents’  actions,  nothing  in  its  environment 
is  fixed. 
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•  Control  is  highly  disp)ersed,  therefore  any  coherent  behav¬ 
ior  there  might  be  in  the  system  has  to  arise  from  competi¬ 
tion  and  cooperation  among  the  agents  themselves, 

•  Many  levels  of  organization,  with  agents  at  one  level 
serving  as  building  blocks  for  the  next  level  up. 

•  Constant  rearrangement  of  the  building  blocks  as  a  re¬ 
sult  of  learning,  experience,  evolution,  and  adaptation. 

•  All  anticipate  the  future  to  some  degree,  making  at¬ 
tempts  at  prediction  on  the  basis  of  models  of  their 
environment. 

•  All  have  niches  they  can  exploit.  Filling  up  one  niche 
often  opens  up  new  ones  that  can  be  exploited,  so  the 
system  never  reaches  equilibrium. 

•  Some  dimensions  can  be  improved  upon  but  never 
optimized. 

•  The  richness  of  the  interactions  within  the  system  al¬ 
lows  the  system  as  a  whole  to  undergo  spontaneous 
self-organization.'^® 

Self-organization  is  a  process  of  attraction  and  repulsion 
in  which  the  internal  organization  of  a  system,  normally  an 
open  system,  increases  in  complexity  without  being  guided 
or  managed  by  an  outside  source.  Emergence  is  the  process 
of  deriving  new  and  coherent  structures,  patterns,  and 
properties  as  an  organization  works  to  fit  itself  to  the  envi¬ 
ronment.  Emergent  phenomena  occur  due  to  the  pattern  of 
interactions  between  the  elements  of  the  system  over  time 
and  are  observable  at  a  macro  level,  even  though  they  are 
generated  by  micro-level  elements.  Emergence  is  also  related 
to  dispersed  control  in  that  decisions  are  made  by  a  variety 
of  elements  in  the  system  rather  than  a  central  governor. 
Adaptability,  or  homeostasis,  is  the  regulation  of  a  system’s 
internal  environment  so  as  to  maintain  a  stable,  constant 
condition  in  relation  to  environmental  changes. 

As  a  model  for  organizations,  complexity  theory  has 
had  a  major  impact  on  modern  organizational  theory. 
Some  would  even  argue  that  cyberspace,  despite  being 
nonbiological,  manifests  such  emergent  properties.  In  fact, 
from  an  overall  war-fighting  standpoint,  the  United  States 
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Marine  Corps  (USMC)  elevated  complexity  theory  as  its  fun¬ 
damental  viewpoint  for  war  fighting  and  explicitly  views 
war-fighting  organizations  as  complex  systems. The 
Marine  Corps  based  its  doctrinal  decision  on  John  Boyd’s 
“Organic  Design  for  Command  and  Control”  (fig.  6)  in  sup¬ 
port  of  its  all-important  maneuver  warfare  doctrine.  How¬ 
ever,  viewing  Boyd’s  design  as  simply  a  model  for  maneuver 
warfare  diminishes  its  conceptual  sophistication  as  a  much 
broader  model  for  organizational  complexity  in  the  face  of 
complex  operating  environments.  In  this  regard,  Boyd  was 
well  ahead  of  his  time  and,  in  fact,  has  much  in  common 
with  Stafford  Beer  and  his  Viable  System  Model. 

Boyd’s  model  more  closely  resembles  a  heterarchy.  As  an 
organizational  form,  a  heterarchy  more  closely  matches  the 
requirements  of  a  viable  system  or  a  complex  adaptive  sys¬ 
tem.  A  heterarchy  is  well  suited  to  handling  challenges  from 
the  environment  that  call  for  flexibility  and  adaptability.  In 
a  heterarchy,  authority  is  laterally  rather  than  vertically 
distributed  and  has  no  fixed  superior  decision-making 
chain.  Heterarchies  are  characterized  by  interdependent 
relationships,  dense  information  nets,  and  distribution  of 
decision-making  power.  Organizational  members  partici¬ 
pate  in  decision  making  regardless  of  their  functional  role, 
position,  or  rank.  The  premium  for  decision-making  authority 
is  based  on  knowledge  and  competence  in  solving  problems 
rather  than  rank  or  time  served  in  the  organization.  In  addi¬ 
tion,  heterarchies  process  more  information  and  use  it  more 
effectively  than  hierarchies.  Communications  channels  arc 
dynamic  and  are  created  and  modified  to  reflect  the  needs 
of  a  particular  situation  or  event.  This  ability  to  dynami¬ 
cally  adapt  to  changing  situations  can  be  viewed  as  a  way 
of  employing  requisite  variety.  The  emphasis  on  knowledge 
contributes  to  the  capacity  of  a  heterarchy  to  generate  a 
variety  of  solutions  to  problems  that  face  the  organization. 
Heterarchies  have  a  greater  ability  to  quickly  integrate 
information  from  multiple  sources  and  achieve  flexibility 
to  adapt  to  changing  circumstances.  A  member  of  a  heter¬ 
archy  can  be  connected  to  any  other  members  without 
needing  to  go  through  or  get  permission  from  anyone.  In 
this  way,  a  heterarchy  distributes  privilege  and  decision 
making  among  participants,  in  contrast  to  a  hierarchy, 
which  assigns  more  power  and  privilege  to  the  members 
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Figure  6.  Organic  Design  for  Command  and  Control.  (Reprinted  from  John  Boyd,  “Organic  Design  for  Command  and  Control, 
unpublished  briefing,  1987) 


higher  in  the  structure.  Heterarchies  include  these  dis¬ 
tinctive  features: 

•  Temporary  associations  out  of  a  pool  of  people  are 
emphasized  rather  than  permanent  structures  and 
changing  people. 

•  Overlap  of  responsibility  is  viewed  as  an  advantage. 

•  Knowledge  is  resident  throughout  the  organization  and 
valued  wherever  it  exists. 

•  Lateral  communication  is  preferred  over  vertical 
communication. 

•  Strategic  nodes  can  emerge  at  any  place  in  the  organiza¬ 
tion  based  on  environmental  contingencies  and  where 
the  requisite  knowledge  to  solve  the  problem  exists. 

•  Upper  levels  of  the  organization  are  viewed  as  orches- 
trators  of  communication  rather  than  solely  agents  of 
control,  monitoring,  and  resource  allocation. 

•  Strategy  is  a  product  of  contributions  across  the  net¬ 
work  rather  than  formulation  and  dissemination  by 
higher  headquarters. 

There  are  downsides  to  cybernetics,  systems  theory,  and 
heterarchies.  Save  for  Boyd’s  theories,  the  major  criticism 
of  cybernetics  and  systems  theory  is  that  they  do  not  ex¬ 
plicitly  incorporate  human  agency  or  moral  factors.  The  hir- 
man  aspects  of  interaction,  cognition,  and  relationships 
and  the  moral  and  emotional  aspects  of  conflict  and  coop¬ 
eration  are  perceived  to  be  immaterial  to  the  function  of  the 
system  and  its  output.  In  effect,  these  approaches  reduce 
humans  to  mere  parts  or  black  boxes,  making  the  models 
necessarily  incomplete.  With  regard  to  complexity  theory, 
its  concrete  scientific  applications  are  so  constrained  (e.g., 
cellular  behavior)  that  the  generalization  of  the  theory  to 
broader  classes,  especially  complex  systems,  is  called  into 
question.  With  regard  to  heterarchies,  a  significant  invest¬ 
ment  of  time,  energy,  and  administrative  and  technical 
support  infrastructure  is  needed  to  maintain  the  dense 
communications  nets  required  to  keep  information  Cow¬ 
ing  at  the  volumes  required  for  effective  collaboration. 
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coordination,  and  action.  In  addition,  the  bias  toward  con¬ 
sensus  in  decision  making  in  heterarchies  creates  the  po¬ 
tential  for  confusion,  sluggish  response  (although  the  re¬ 
sponse  may  be  perfectly  appropriate,  it  is  too  late  to  address 
the  need),  and  gridlock.  Finally,  the  lack  of  a  central  gover¬ 
nor  or  prescribed  chain  of  authority  in  a  heterarchy  results 
in  difficulty  in  achieving  global  optimization,  long-term 
plans  of  action,  and  predictable  performance. 


Cognitive -Psychological  Models 

As  a  remedy  to  the  issues  associated  with  cybernetics- 
systems  models,  several  efforts  have  been  made  to  address 
cognitive  and  psychological  factors  in  command  and  con¬ 
trol.  Carl  Builders  “Command  Concept  C2”  is  one  such 
effort. Builder’s  analysis  is  “driven  by  the  need  to  sepa¬ 
rate  the  intellectual  performance  of  the  commander  from 
the  technical  performance  of  the  C2  system.”  (emphasis 
added)  He  further  states  that  the  “essence  of  command  lies 
in  the  cognitive  processes  of  the  Commander.”^^  Builder 
places  emphasis  on  preparation  for  battle  using  the  C2 
system  rather  than  orchestration  and  improvisation.  In 
addition,  he  views  information  as  important  when  devel¬ 
oping  the  command  concept,  but  real-time  information  is 
not  especially  relevant  to  altering  the  outcome  of  a  conflict. 
In  this  regard.  Command  Concept  C2  diverges  dramatically 
from  the  cybernetic-systems  view,  which  holds  that  infor¬ 
mation  is  essential  to  adaptation.  However,  in  the  end, 
Builder  s  theory  is  cybernetic  in  nature  as  he  claims  that 
“the  formulation  and  transmission  of  the  commander’s 
concept  could  be  considered  as  the  content  of  the  C2  sys¬ 
tem. This  means  that  the  Command  Concept  C2  would 
have  to  be  integrated  into  an  overall  C2  model,  which  in  all 
likelihood  would  be  cybernetic. 

Another  cognitive-psychological  approach  has  been  for¬ 
mulated  by  Ralph  Stacey  that  incorporates  relationship 
psychology  to  account  for  human  interaction.^'^  Stacey  is  a 
proponent  of  complexity  theory  but  believes  it  has  been 
misapplied.  His  approach  is  in  part  a  reaction  to  the  func¬ 
tionalist  point  of  view  embedded  in  all  systems  thinking, 
exemplified  by  his  opinion  that  “the  radical  potential  of  theo¬ 
ries  of  chaos  and  dissipative  structures  for  organization 
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theory  tends  to  be  obscured  by  simulations  of  this  kind 
because  the  agents  in  the  system  are  treated  in  an  im¬ 
personal  way."  Instead,  he  takes  a  constructivist  approach 
and  proposes  organizations  as  "complex  responsive  pro¬ 
cesses"  based  on  interacting  themes,  eonversations,  and 
relationships.  In  other  words,  members  of  the  organization 
continuously  build  an  organizational  narrative  and  thereby 
shape  and  reshape  the  power  relationships  and  actions 
that  the  organization  takes  to  deal  with  its  environment. 
Stacey’s  approach  is  not  so  much  a  model  as  it  is  a  compet¬ 
ing  philosophical  viewpoint  that  places  human  interaction 
at  the  center  of  organizations.  It  is  human-to-human  inter¬ 
action  that  exercises  "ordinary'  daily  human  freedom.  .  .  to 
weave  actions  into  and  around  the  system.  .  .  in  order  to 
cope"  with  the  environment  and  "get  things  done."^^  Stacy 
presents  a  compelling  ease,  but  at  the  moment  it  remains  a 
theoretical  one.  Although  models  for  complex  responsive 
processes  could  emerge  over  time,  for  now  the  theory  re¬ 
mains  just  that — theory. 


The  Hybrid  Form 

Both  hierarchies  and  heterarchies  have  strengths  and 
weaknesses.  A  critical  weakness  of  hierarchies  is  that  their 
top-down,  authority-driven  structure  does  not  have  the 
requisite  variety  to  respond  to  the  VUCA  cyberspace  envi¬ 
ronment.  On  the  other  hand,  heterarchies  lack  a  mechanism 
to  provide  for  global  direction  and  predictable  performance. 
Another  organizational  option  is  to  combine  the  strengths  of 
both  and  minimize  their  weaknesses  in  order  to  provide  the 
means  to  resolve  the  need  for  control  and  direction  on  the 
one  hand  and  flexibility  and  adaptation  on  the  other.  A  hy¬ 
brid  organization,  properly  designed,  employs  the  best  attri¬ 
butes  of  hierarchy  and  heterarchy.  Command  and  control  in 
a  hybrid  organization  moves  away  from  the  traditional  C2 
model  by  uncoupling  command  from  control. Command 
involv^cs  the  making  of  strategy  and  setting  conditions  for 
action  through  planning,  resourcing,  and  facilitating  infor¬ 
mation  flow  throughout  the  organization.  Control  is  not  a 
function  of  command  but  emerges  as  a  function  of  organiza¬ 
tional  structure:  resource,  information,  and  knowledge  flows; 
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and  the  environment  (which  includes  adversaries).^^  Beer’s 
Viable  System  Model  exemplifies  this  approach. 

From  a  military  standpoint,  a  key  example  of  the  hybrid 
form  was  during  World  War  I  on  the  Western  Front  when 
the  German  army  formally  implemented  storm  trooper  tac¬ 
tics  to  break  the  stalemate  of  trench  warfare  with  its  lethal 
concentration  of  industrial  age  firepower.  The  Germans 
relied  heavily  on  Auftragstaktik,  or  mission-type  orders,  as 
an  approach  to  operations  wherein  “a  military  commander 
gives  their  subordinate  leaders  a  clearly  defined  goal  (the 
mission)  and  the  forces  needed  to  accomplish  that  goal  with 
a  time  within  which  the  goal  must  be  reached.  The  subordi¬ 
nate  leaders  then  implement  the  order  independently.  The 
subordinate  leader  is  given,  to  a  large  extent,  the  planning 
initiative  and  a  freedom  in  execution  which  allows  flexibility 
in  execution.  Mission-type  tactics  free  higher  leadership 
from  tactical  details. 

To  be  sure,  Auftragstaktik  is  a  way  of  increasing  the  au¬ 
tonomy  of  the  military  organization,  its  capacity  to  maneuver 
quickly,  and  the  initiative  of  its  individual  members  in  the 
face  of  a  more  complex  and  deadly  battlefield  environment. 
In  effect,  it  patches  around  the  infiexibility  of  a  standard 
hierarchical  organization  and  in  its  own  way  uniquely  ad¬ 
dresses  the  Clausewitzian  realities  of  emotion,  chance,  and 
friction  in  the  VUCA  environment.  Even  though  mission- 
type  orders  are  institutionalized  as  part  of  US  war-fighting 
doctrine,  this  does  not  go  nearly  far  enough  to  allow  the 
armed  forces  to  succeed  in  the  h3rpercompetitive  cyberspace 
domain. Although  not  touted  as  such,  the  concept  of  net¬ 
work-centric  warfare  has  the  potential  to  move  the  armed 
forces  toward  a  hybrid  organizational  form  more  in  tune 
with  the  requirements  of  a  VUCA  cyberspace  environment. 
To  do  this,  network-centric  warfare  should  not  be  viewed  as 
a  ‘Value  proposition”  or  “new  form  of  warfare”  but  rather  as 
a  way  to  increase  the  requisite  variety  of  military  organiza¬ 
tions  to  deal  with  the  VUCA  environment.^^  Quite  simply, 
an  organization  that  is  networked  and  provisioned  with  rich 
information  flows,  reconflgurable  (and  highly  automated) 
processes,  knowledge-based  practitioners,  and — especially 
key — control  flexibility  will  display  a  greater  capacity  to 
successfully  adapt  to  internal  and  external  threats  and 
exploit  emerging  opportunities.  This  type  of  organization 
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blends  the  best  of  the  hierarchical  and  heterarchical  organi¬ 
zational  forms  and  best  applies  to  the  cyberspace  domain. 

Criteria  for  Cyberspace 
Command  and  Control 

Based  on  the  above  analysis,  we  argue  that  the  historical- 
traditional  model  of  C2  is  inappropriately  restrictive  for  the 
cyberspace  domain.  What  is  needed  is  an  approach  to  C2 
that  allows  more  flexibility  to  conceptualize  and  match  its 
fundamental  purpose  to  the  environment  in  which  it  is  exer¬ 
cised.  As  stated  previously,  we  use  Bremer  and  Orr,  who 
view  the  purpose  of  C2  as  the  direction  and  coordination  of 
operations  to  produce  desired  effects  according  to  the  com- 
manders  intent  through  the  positioning  of  forces  at  the 
time  and  place  they  are  needed. In  addition,  we  adopt  the 
positions  of  Builder  and  Georgiy  Levchuk  et  al.,  and  indi¬ 
rectly  Volberda,  who  all  advocate  the  conceptual  delinking 
of  command  from  control.  In  this  view,  the  role  of  command 
is  to  continually  survey  the  internal  and  external  environ¬ 
ments  and  ensure  the  organization’s  inputs,  processes, 
interactions,  and  information  flows  are  calibrated  properly 
to  achieve  the  organization’s  goals.  Command  involves  the 
surveying,  contemplating,  and  monitoring  of  the  organiza¬ 
tion’s  fitness  to  the  environment,  and — when  necessary — 
directing  adjustments  to  the  organization’s  structure  in 
order  to  assure  ongoing  performance  and  survival.  On  the 
other  hand,  control  is  distributed  throughout  the  organiza¬ 
tion  and  supported  by  dense  nets  of  information  flows,  inter¬ 
actions,  and  knowledge-based  decision  making  and  engage¬ 
ment  within  the  organization  and  with  the  environment. 

The  environment  in  which  cyberspace  operations  are  con¬ 
ducted  produces  certain  mandatory  requirements  for  the 
armed  forces  to  successfully  compete  in  the  domain.  The 
VUCA  strategic  environment;  the  speed,  multidimensional 
complexity,  and  rapid  technological  innovation  characteristic 
of  cyberspace:  and  the  nature  of  competition  and  change  in 
cyberspace  call  for  a  C2  function  that  can  continually  match 
this  environment  and  impact  the  environment  itself  for  the 
benefit  of  the  objectives  for  which  cyberspace  operations  are 
employed.  Wc  propose  seven  criteria  for  cyberspace  C2 
that,  if  met,  will  place  the  armed  forces  in  a  position  to 
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best  orchestrate  cyberspace  operations.  These  criteria  in¬ 
clude  speed,  adaptability,  alertness,  flexibility,  responsive¬ 
ness,  resilience,  and  efficiency. 

Speed  is  the  sine  qua  non  of  cyberspace  operations. 
Two  types  of  speed  are  needed  to  compete  in  the  cyber¬ 
space  domain.  First,  the  cyberspace  C2  function  and  the 
technology  that  supports  it  must  be  capable  of  operating 
at  speeds  that  enable  appropriate  responses  and  pre¬ 
ventive  actions.  The  speeds  required  will  be  variable  but 
should  incorporate  the  potential  to  achieve  two-thirds  the 
speed  of  light,  which  is  built  into  the  infrastructure  of  the 
domain  itself.  Second,  cyberspace  organizations  must  ex¬ 
hibit  a  speed  of  adaptation,  planning,  innovation,  and 
implementation  that  meets  or  exceeds  the  rate  of  intro¬ 
duction  of  new  attack  vectors;  novel  tactics,  techniques, 
and  procedures;  and  technological  innovation  and  imple¬ 
mentation.  This  type  of  speed  is  necessarily  slower  than 
the  information  flows  that  transit  cyberspace;  however, 
without  it,  cyberspace  C2  would  not  be  capable  of  the 
adaptation  needed  to  maximize  the  opportunity  offered 
by  the  raw  speed  of  the  domain. 

The  hypercompetitivc  nature  of  cyberspace  is  character¬ 
ized  by  continuous  change  and  innovation.  This  requires  an 
adaptable  organization  that  is  able  through  its  C2  capabil¬ 
ity  to  (1)  correctly  perceive  and  appropriately  deal  with  the 
external  environment,  (2)  maintain  high  levels  of  informa¬ 
tion  exchange  and  cooperation  within  the  organization  in 
order  to  formulate  options,  and  (3)  dynamically  restructure 
processes,  decision-making  relationships,  and  behaviors  to 
effectively  implement  change  options  to  deal  with  the  ex¬ 
ternal  environment.  In  terms  of  war  fighting,  cyberspace 
C2  must  be  adaptable  in  the  face  of  all  types  of  threats, 
across  the  entire  range  of  military  operations,  and  at  all  lev¬ 
els  of  war — strategic,  operational,  and  tactical.  The  criteria 
of  alertness,  flexibility,  responsiveness,  and  resilience  are 
driven  by  the  requirement  for  speed  and  are  directly  related 
to  adaptability. 

Alertness  refers  to  timely  awareness  of  existing  or  antici¬ 
pated  changes  internal  to  the  organization  or  in  the  operat¬ 
ing  environment.®^  It  implies  a  multidimensional  under¬ 
standing  of  the  current  and  projected  status  of  the 
cyberspace  domain  in  relation  to  the  larger  operational 
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environment.  Alertness  also  includes  the  capacity  for  situ¬ 
ational  awareness  of  the  technical  parameters  that  com¬ 
prise  the  cyberspace  infrastructure.  Particularly  important 
is  the  anticipation  of  adversary  action  and  innovation,  areas 
that  require  the  intense  application  of  intelligence  operations. 
In  addition,  it  points  the  organization  toward  the  threats  and 
opportunities  associated  with  emerging  capabilities  and  in¬ 
novations  and  how  the  organization  might  deal  with  a  threat 
or  capitalize  on  an  opportunity.^ 

According  to  Volberda,  control  flexibility  is  “the  degree  to 
which  an  organization  has  a  variety  of  managerial  capabili¬ 
ties  and  the  speed  at  which  they  can  be  activated  to  in¬ 
crease  the  control  capacity  of  management  and  improve  the 
controllability  of  the  organization.”^’'^  Flexibility,  then,  can 
be  viewed  as  the  governor  of  adaptability  and  management’s 
most  important  C2  task.  Without  it,  an  organization  could 
fail  to  adapt  or  perhaps  yield  to  a  series  of  mindless  adapta¬ 
tions  that  lead  to  disintegration.  It  follows  that  cyberspace 
C2  must  be  flexible  enough  to  continue  to  operate  in  new  or 
changed  scenarios  rather  than  remaining  set  in  static  con¬ 
figurations. 

Responsiveness  refers  to  the  change  capacity  of  an  organi¬ 
zation’s  processes  once  it  is  found  that  adjustments  must  be 
nuide  to  positively  adapt  to  internal  or  external  threats  and 
opportunities.^  Responsiveness  relates  to  the  development  of 
variety  in  the  choice  and  design  of  C2  processes  in  order  to 
ensure  tliat  information  inputs  and  decisions  are  transformed 
into  the  effects  needed  for  a  particular  situation  appearing  in 
the  environment.  Responsive  processes  must  be  rapidly  re- 
conligumblc  (polymorphic),  automated  where  possible,  and 
supported  by  appropriate  levels  of  information,  knowledge, 
competence,  resources,  and  a  cultural  bias  in  the  organiz>a- 
tion  that  understands  and  supports  the  need  for  change. 

Resilience  is  the  ability  of  cyberspace  C2  to  withstand  at¬ 
tack  or  other  forms  of  significant  shock  and  discontinuity.  A 
resilient  cyberspace  C2  capability  would  enable  an  organiza¬ 
tion  to  continue  to  operate,  adapt,  and  survive  in  the  VUCA 
cyberspace  environment  in  the  face  of  damage,  degradation, 
disruption,  or  destruction. 

Cyberspace  C2  efficiency  reUites  to  how  well  information, 
time,  and  resources  are  used  throughout  the  organization 
to  feed  processes  and  decision  making  in  order  to  produce 
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the  desired  output  in  the  fastest,  most  economical,  and 
highest  quality  way.  In  practice,  cyberspace  C2  efficiency 
can  also  reduce  the  deployed  footprint,  decrease  the  de¬ 
mand  for  scarce  resources,  and  leverage  economies  of 
scale  across  time  and  space.  Achieving  cyberspace  C2  ef¬ 
ficiency  requires  a  well-designed  technical  architecture, 
high-volume  yet  appropriately  tailored  and  calibrated  in¬ 
formation  flows,  multidimensional  situational  awareness, 
and  well-trained  and  educated  practitioners. 

To  be  sure,  this  set  of  criteria  is  abbreviated.  However, 
the  criteria  are  based  on  solid  academic  research  and  the 
practical  experience  of  today’s  operational  environment, 
and  therefore  for  our  purposes  they  are  sufficient  to  begin 
to  relate  the  requirements  of  the  cyberspace  domain  to  the 
choice  of  an  appropriately  matched  C2  model.  If  one  as¬ 
sumes  that  C2  is  as  essential  for  cyberspace  operations  as 
it  is  in  any  other  war-fighting  domain,  the  question  at  hand 
becomes  what  is  the  best  form  of  C2  to  exercise  command 
and  achieve  desired  military  results  in  cyberspace?  Al¬ 
though  it  stands  to  reason  that  cyberspace  operations  share 
similar  C2  elements  as  other  war-fighting  domains  such  as 
organization;  technical  systems;  and  tactics,  techniques, 
and  procedures,  we  assert  that  the  most  effective  C2  method 
for  cyberspace  operations  will  be  heavily  influenced  by  the 
nature  of  the  domain  itself  and  the  environment  within 
which  it  exists.®'^ 


Evaluation  of  Models 

To  arrive  at  a  decision  regarding  which  C2  model  to  rec¬ 
ommend,  we  developed  a  straightforward  decision  matrix  to 
evaluate  each  model  based  upon  the  seven  criteria  de¬ 
scribed  earlier.  We  chose  the  decision  matrix  because  we 
felt  this  tool  would  help  us  arrive  at  a  quantitative  decision 
even  though  the  evaluation  of  how  each  model  met  the  cri¬ 
teria  is  subjective.  We  will  explain  later  how  we  arrived  at 
each  of  our  evaluations. 

We  grouped  the  various  C2  constructs  discussed  earlier 
into  three  bins  for  the  purpose  of  evaluation.  These  group¬ 
ings  centered  on  hierarchical,  heterarchical,  and  hybrid  C2 
models.  The  matrix  is  filled  in  using  a  scale  of  1  to  5,  with  1 
being  the  least  effective  and  5  being  the  most  effective.  We 
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did  not  weight  any  criteria  higher  than  any  other  because 
we  felt  each  item  was  equally  important  to  the  evaluation  of 
the  C2  models  (see  fig.  7). 


Hierarchical 

Heterarchical 

Hybrid 

Speed 

3 

4 

5 

Adaptability 

1 

3 

3 

Alertness 

3 

5 

5 

Flexibility 

1 

3 

3 

Responsiveness 

3 

5 

5 

Resilience 

5 

1 

5 

Efficiency 

3 

3 

4 

Totals 

19 

24 

30 

Figure  7  Decision  matrix 


As  previously  discussed,  the  hierarchical  model  is  not 
quick  to  react  to  change  in  the  emaronmenl  nor  is  it  a  very 
quick  method  to  disseminate  orders  from  top  to  bottom. 
This  is  due  to  the  necessary  vetting  and  approval  process 
that  a  hierarchical  organization  employs.  The  heterarchical 
model  is  very  quick  due  to  its  distributed  nature  and  reli¬ 
ance  upon  very  distributed  decision  making.  However,  un¬ 
like  the  hierarchical  model,  there  is  a  significant  loss  in 
uniform,  homogenous  decision  making  and  synchronized, 
macro-oriented  direction.  The  hybrid  model,  while  not  as 
quick  to  disseminate  orders,  still  retains  lower  level  deci¬ 
sion-making  authority,  which  enables  local  C2  of  an  issue 
while  still  incorporating  the  best  aspects  of  a  hierarchical 
command  structure.  This  allows  time  to  be  used  most  effi¬ 
ciently  at  multiple  layers  within  this  model  due  to  each  or¬ 
ganization  working  its  level  of  the  action. 

A  heterarchical  system  is  adaptable,  depending  upon  the 
local  organization.  How  the  lower  echelons  of  command  de¬ 
cide  to  adapt  to  a  certain  situation  results  in  a  disjointed 
and  inconsistent  effort  across  the  spectrum,  as  one  organi¬ 
zation  will  adapt  to  a  changing  environment  one  way  while 
another  adapts  differently.  While  there  should  be  resilient 
communication  flows  between  the  organizations’  best  prac¬ 
tices  and  past  lessons  learned,  this  does  not  mean  that 
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these  will  necessarily  be  incorporated.  In  contrast,  the  hier¬ 
archical  C2  structure  is  adaptable  only  so  far  as  the  parent 
command  allows.  In  today’s  remote,  deployed  environment, 
commanders  far  removed  from  the  scene  may  not  fully  un¬ 
derstand  the  problem  set  or  the  need  to  deviate  from  estab¬ 
lished  parameters.  Additionally,  the  downward-directed 
adaptation  may  fall  well  short  in  time  and  purpose  of  what 
is  needed  at  the  local  level  and  may  not  be  feasible  across 
the  entire  cyberspace  domain.  The  hybrid  C2  structure  re¬ 
sults  in  an  organization  that  can  adapt  as  the  situation 
presents  itself  while  still  conforming  to  an  established  set  of 
goal-oriented  guidelines. 

Assuming  a  level  playing  field  (sufficient  and  similar 
technologies  deployed  across  the  three  models),  we  believe 
that  all  three  models  can  achieve  similar  levels  of  alertness. 
The  technological  advances  of  the  last  decade  enable  com¬ 
manders  in  all  domains  of  warfare  to  be  cognizant  of  the 
lowest  level  of  tactical  events  on  the  battlefield.  So  it  can  be 
with  cyberspace.  It  is  feasible  for  any  C2  structure  within 
cyberspace  to  be  aware  of  the  lowest -level  event,  to  monitor 
it,  and  to  direct  actions  mitigating  the  seriousness  of  the 
event.  We  could  not  discern  a  difference  between  the  three 
models  worthy  of  distinction. 

As  with  adaptability,  the  hybrid  model  is  the  most  flexible 
of  the  three.  As  stated  before,  combining  the  best  attributes 
of  each  allows  for  a  C2  structure  that  can  change  based 
upon  localized  mission  requirements  while  still  preserving 
a  similar  enough  structure  that  it  retains  strong  similarities 
to  others.  The  hierarchical  model,  again,  will  flex  as  much 
as  parent  commands  allow,  which  may  not  be  enough  for 
the  situation  and  may  not  apply  or  be  useful  to  the  entire 
hierarchical  C2  structure.  The  same  adaptability  detractors 
for  the  heterarchical  model  apply  here  as  well. 

Assuming  proper  intelligence  and  warning,  a  hierarchi¬ 
cal  model  can  be  highly  responsive.  To  pretend  otherwise 
would  be  to  dismiss  centuries  of  warfare  and  all  relevant 
examples.  There  are,  obviously,  instances  where  intelli¬ 
gence  and  warning  were  not  available  or  properly  utilized 
(the  attack  at  Pearl  Harbor  as  an  example);  however,  this  is 
not  indicative  of  the  entire  C2  model.  Likewise,  a  heter¬ 
archical  model  can  also  be  exceptionally  responsive  across 
the  entire  range.  Once  again,  one  does  run  into  the  disjointed 
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approach  that  a  heterarchical  model  would  employ  across 
the  entire  cyberspace  domain.  As  also  mentioned  before, 
the  hybrid  model  would  enjoy  the  benefits  of  being  responsive 
to  an  event  while  working  wltdiin  tdie  hierarchical  guidance. 

Both  the  hybrid  and  hierarchical  models  would  prove  to 
be  resilient.  By  virtue  of  their  nature,  these  two  models  en¬ 
joy  the  advantages  of  parent  command  structures  enabling 
higher-level  commands  to  implement  initiatives  to  deal  with 
eventualities.  These  types  of  issues  could  range  from  the 
physical  destruction  of  a  site  to  the  failure  of  a  local  organi¬ 
zation  to  implement  certain  actions  designed  to  protect  the 
entire  cyberspace  domain.  However,  a  heterarchical  organi¬ 
zation  could  benefit  from  a  resilient  command  structure 
that  would  enable  it  to  survive  multiple  failures  (regardless 
of  source,  duration,  or  effect)  without  serious  degradcition 
of  the  domain. 

Assuming  a  level  playing  field,  all  of  these  C2  models  can 
be  efficient — there  is  no  salient  feature  of  the  models  that 
causes  any  to  be  unnecessarily  inefficient.  The  heterarchi¬ 
cal  model  could  be  the  most  inefficient  of  all  three.  While  it 
can  execute  with  minimal  overhead,  the  disparate  nature  of 
the  model  results  in  increased  overhead  in  training  vari¬ 
ances  coupled  with  technical  variances.  The  hierarchical 
model  is  likewise  inefficient  in  that  it  seeks  an  overall  ap¬ 
proach  to  events  and  can  be  inefficient  in  allocation  of  re¬ 
sources  and  command  guidance  to  deal  with  cyberspace 
events.  The  hybrid  model  incorporates  the  strengths  of  both 
as  it  enables  C2  that  is  as  efficient  as  the  other  attributes  of 
tfie  domain  and  C2  model  allow. 


Recommendations 

The  current  hierarchical  C2  structure  which  serv^es  other 
domains  well  docs  not  work  at  optimal  levels  for  exercising 
global  C2  of  our  newest  domain — cyberspace.  Accordingly, 
our  research  and  analysis  point  to  a  new  model  to  be  em¬ 
braced  by  the  DOD — a  hybrid  model.  To  be  sure,  this  model 
possesses  its  own  unique  weaknesses,  and  it  will  take  time 
and  effort  to  fully  vet  this  new  approach.  Nevertheless,  the 
hybrid  model  is  the  strongest  of  the  three  wc  analyzed  for 
cyberspace  C2.  Figure  8,  shown  below,  is  how  we  envision 
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the  command  and  informational  relationships  in  this  new 
model.  It  is  important  to  note  the  difference  between  the 
command  and  informational  connections.  We  believe  it  is 
essential  in  the  hybrid  model  that  information  about  the 
domain  as  a  whole,  as  well  as  specific  incidents,  is  shared 
quickly  and  without  prejudice  so  that  commanders  at  all 
levels  can  take  the  necessary  actions  within  their  span  of 
control.  Important  to  note  is  that  information  flows  exist  at 
and  between  all  levels  of  the  C2  model  and  across  current 
organizational  lines.  These  flows  enable  the  advantages  dis¬ 
cussed  previously  by  allowing  all  levels  of  command  to 
tackle  problems  simultaneously  while  also  ensuring  a  uni¬ 
fied  higher  headquarters  command  approach.  Perhaps 
most  importantly  for  this  model,  the  power  to  respond  to 
and  deal  with  events  is  placed  in  the  hands  of  personnel 
who  have  the  best  knowledge,  no  matter  their  rank.  Teams 
are  then  rapidly  formed,  disbanded,  and  reformed  as  events 
continue  to  ebb,  peak,  and  flow. 

The  next  model  (fig.  9)  shows  a  basic  organizational  ele¬ 
ment  of  the  hybrid  model.  We  envision  that  these  organiza- 


Command  and  Information 
Control  and  Information 


Figure  8.  Proposed  hybrid  C2  model 
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tions  will  utilize  this  basic  model  and  its  method  of  com¬ 
mand  and  control  to  become  part  of  a  learning  organization 
where  all  levels  are  informed  and  cognizant  of  events  and 
activities,  regardless  of  where  these  occur. 

In  order  to  successfully  implement  the  hybrid  model,  it 
will  be  necessary  to  identify,  recruit,  and  develop  a  new  set 


-  Directives  Received 

-  Guidance 

-  Policies 


Activities 

Decision  Making 

-  Policies 

-  Actions 


Figure  9.  Organizational  implementation  of  the  hybrid  C2  model 


of  “cyberspace  warriors”  who  receive  not  only  the  unique 
training  demanded  of  this  domain  but  also  the  training  and 
education  regarding  the  new  C2  model  and  how  they  are  to 
operate  within  it.  As  author  Col  Thomas  Hammes,  USMC, 
states  in  his  groundbreaking  treatise  on  fourth -generation 
warfare  (4GW),  it  will  be  necessary  to  “select  and  promote 
intelligent,  innovative  people  and  ensure  that  they  are  free 
to  experiment  and  fail — provided  they  learn  from  those  fail¬ 
ures. Not  only  is  this  important  in  4GW,  it  will  also  be 
important  to  cyberspace  in  order  to  enable  “a  creative  mem¬ 
ber  [to]  literally  tap  the  world  for  information,  ideas,  and 
techniques  that  apply  to  his  or  her  mission. This  will 
also  require  reeducating  a  whole  new  cadre  of  leaders  who 
understand  the  importance  of  unconstrained  information 
flow  and  how  command  must  be  employed  in  a  highly  adap¬ 
tive  organization. 
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There  will  also  be  a  need  to  increase  resource  assignment 
in  this  domain.  In  order  to  establish  these  robust  information 
links  where  data,  intelligence,  and  information  regarding  the 
domain  are  passed  effortlessly  and  seamlessly,  resources 
will  need  to  be  applied  to  enable  this  connectivity.  Not  only 
will  large  and  redundant  communications  links  need  to  be 
installed  but  also  the  necessary  hardware  and  software  to 
take  advantage  of  these  increased  sources  of  information. 
These  resources  must  be  implemented  such  that  these  orga¬ 
nizations  embrace  the  new  technologies  which  enable  fast, 
adaptive  processes  using  distributed,  recombinant — and 
evolutionary — capability  based  on  threat  and  environmental 
changes.  We  must  continue  to  move  to  an  autonomic  tech¬ 
nological  infrastructure  focusing  on  speed  and  “smart  auto¬ 
mated”  infrastructure  management. 

Additionally,  organizations  will  have  to  produce  new  doc¬ 
trine  and  guidance  on  how  to  deal  with  the  new  information 
available  to  all.  Joint  Vision  2020,  originally  published  in 
2000,  is  on  target — information  superiority  and  the  use  of  it 
is  a  requirement  for  successful  cyberspace  dominance  as  is 
network-centric  warfare,  properly  understood.  History  is 
replete  with  examples  of  information  being  available  but  not 
acted  upon  with  disastrous  results  (e.g.,  Maj  Gen  Joseph 
Hooker  at  Chancellorsville). 

Changes  in  higher-level,  presidential-granted  authori¬ 
ties  will  also  be  required.  While  the  2008  UCP  is  a  positive 
step  forward,  the  lines  of  authority  are  still  confused,  ill 
defined,  and  ultimately  inappropriate  for  cyberspace  C2.  It 
is  necessary  in  the  hybrid  model  to  set  the  parameters  for 
organizations  to  exercise  their  authority  in  a  productive, 
collaborative  fashion.  This  could  require  the  movement 
away  from  the  investiture  of  the  cyberspace  domain  into  a 
multirole  functional  combatant  command  and  toward  a 
domain-oriented  command  where  the  power  of  cyberspace 
can  be  maximized.  This  would  also  fulfill  the  tenants  of 
unity  of  command  and  unity  of  effort,  two  long-enduring 
principles  of  warfare. 

Another  area  to  address  is  how  joint  and  coalition  forces 
will  implement  and  work  within  this  construct.  One  option 
to  investigate  further  to  organize  and  employ  Joint  forces  in 
accordance  with  the  hybrid  model  is  a  joint  force  cyber¬ 
space  component  commander  (JFCCC).  A  JFCCC  will  con- 


48 


solidate  the  planning  and  operations  functions  currently 
performed  by  the  various  J-6  staffs  across  the  combatant 
commands  and  place  them  in  a  full-time  operational  com¬ 
mand  structure.  Additionally,  it  will  elevate  the  cyberspace 
domain  on  par  with  similar  functional  components  such  as 
the  Joint  force  air,  land,  and  maritime  component  com¬ 
manders.  Given  that  events  are  occurring  continuously  in 
cyberspace,  it  is  possible  that  the  JFCCC  could  be  estab¬ 
lished  as  a  global,  full-time  component  of  USSTRATCOM. 
Following  this  logic,  it  would  be  necessary  to  extend  the 
cyberspace  C2  model  on  a  worldwide  basis  and  ensure  ad¬ 
ditional  linkages  to  the  operational  level.  To  this  end,  one 
can  conceive  of  "cyberspace  coordination  elements”  or  "direc¬ 
tors  of  cyber  forees-forward”  embedded  within  the  other 
combatant  commands  and  service  components.  This  is  an 
area  for  further  investigation  as  the  DOD  moves  to  adopt 
the  hybrid  model  for  cyberspace  C2. 


Conclusion 

Based  on  the  results  of  this  study,  it  is  clear  that  for 
the  armed  forces  to  have  any  realistic  chance  of  success  in 
cyberspace,  they  must  acknowledge  that  the  hybrid  form  is 
best  matched  to  respond  to  the  hypercompetitive.  complex, 
and  technological  nature  of  the  cyberspace  domain.  The 
hybrid  form  necessarily  moves  the  armed  forces  away  from 
the  doctrinal  superficialities  of  organizational  wiring  dia¬ 
grams  and  traditional  military-bureaucratic  biases  toward 
hierarchies  and  vertical  control.  Instead,  with  the  hybrid 
form,  cyberspace  C2  is  established  upon  a  force  that  prizes 
knowledge  ahead  of  rank  and  experience  and  that  is  bound 
together  by  rich,  ubiquitous  information  flows  that  connect 
all  participants  at  all  levels  of  the  cyber  fight.  It  is  able  to 
aehieve  high  operating  speeds  both  in  terms  of  the  raw  po¬ 
tential  of  information  transfer  and  in  terms  of  adaptation, 
planning,  dynamic  restructuring,  decision  making,  innova¬ 
tion,  and  implementation.  Such  an  organization  is  also  able 
to  handle  the  continuous  change  that  is  characteristic  of 
the  domain. 

With  the  hybrid  form,  the  cyber  force  is  intrinsically  pos¬ 
tured  to  meet  emerging  threats  at  all  levels  of  war  due  to 
its  cilertncss,  flexibility,  responsiveness,  and  resilienee.  C2 
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is  based  on  a  pervasive  understanding  of  the  internal  and 
external  operating  environments,  where  decision  makers 
translate  deep  situational  awareness  into  anticipatory  opera¬ 
tional  responses,  scaled  and  tailored  technologically  and 
procedurally  to  the  situation.  Cyber  leaders  demonstrate 
war-fighting  skill  according  to  their  ability  to  decisively  cali¬ 
brate  the  control  needed  to  deal  with  an  event  and  improve 
the  controllability  of  the  organization  in  the  face  of  novel, 
fast-developing  situations  arising  from  the  larger  operational 
environment.  These  leaders  are  also  the  guarantors  of  the 
principle  of  variety  in  the  choice,  design,  resilience,  and 
efficiency  of  C2  processes.  In  the  hybrid  model,  the  cyber 
leader  is  the  governor  of  cyberspace  C2. 

If  the  case  for  the  hybrid  form  is  convincing,  the  next 
step  is  to  implement  it  throughout  the  DOD.  In  that  regard, 
a  JFCCC  is  a  potential  solution,  providing  a  solid  doctrinal 
basis  for  war-fighting  organizations  while  also  setting  the 
stage  to  go  beyond  traditional  doctrinal  notions  of  C2  as  ap¬ 
plied  to  the  exacting  requirements  of  the  cyberspace  domain. 
The  JFCCC  organization  must  embody  the  very  essence  of  the 
hybrid  model  wherein  processes  are  rapidly  reconfigurable, 
automated,  and  supported  by  a  well-designed  technical 
architecture,  high-quality  information  flows,  deep  aware¬ 
ness,  and  thoroughly  educated  practitioners.  The  JFCCC 
must  be  simultaneously  global,  regional,  and  local  in 
focus,  an  objective  that  will  be  achieved  through  the  very 
structure,  processes,  practice,  and  governance  of  the  hybrid 
form  itself. 

To  be  sure,  some  will  question  whether  the  hybrid  model 
can  work  within  the  strict,  hierarchical  environment  of  the 
US  military.  True,  our  argument  for  a  “new”  cyberspace  C2 
approach  is  not  exactly  new.  It  has  been  echoed  throughout 
the  military  literature  since  the  onset  of  the  “information 
revolution”  in  the  1990s,  and  the  DOD  has  been  wrestling 
with  it  for  much  of  that  time.^^  In  the  organizational  develop¬ 
ment  literature,  the  recognition  goes  back  to  the  1960s. 
However,  what  is  new  and  what  this  study  has  shown  is 
that  the  evidence  for  the  need  to  move  to  the  hybrid  model 
is  irrefutable — theory  has  merged  with  practice.  The  nature 
of  the  hypercompetitive  cyberspace  domain  is  such  that  the 
DOD  must  change  its  approach  if  cyberspace  military  supe¬ 
riority  is  to  be  achieved  now  and  into  the  future.  One  need 
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only  recognize  the  astonishing  number  of  computer  net¬ 
work  intrusions  and  data  exfiltrations  to  understand  the 
scope  of  the  threat.  Even  our  most  sophisticated  weapons 
systems  are  not  exempt.  Increasingly  sophisticated  cyber 
weaponry  is  readily  available  on  hacker  Web  sites,  and  at¬ 
tack  anonymity  is  easily  achieved,  making  attribution  and 
response  problematic.  Offensive  overmatch  is  the  rule, 
given  that  our  defenses  are  largely  reactive — engineered  to 
respond  after  attacks  have  already  occurred — if  they  are 
detected  at  all.  As  the  world’s  most  technologically  advanced 
military,  the  armed  forces  are  absolutely  dependent  on 
cyberspace  to  perform  their  war -fighting,  intelligence, 
and  business  missions.  The  interdependent  Joint  team 
cannot  fight  without  cyberspace. 

That  is  why,  at  its  heart,  this  study  is  an  urgent  call  for 
radical  cyberspace  C2  reform  across  the  DOD.  In  order  to 
meet  the  challenge  of  cyberspace  operations  today  and  into 
the  future,  the  armed  forces  must  move  away  from  their 
traditional,  hierarchical  C2  structure.  Instead,  they  must 
embrace  the  hybrid  model  and  the  opportunities  for  war- 
fighting  performance  offered  by  the  establishment  of  a  JFCCC 
structured  along  the  lines  of  the  model.  We  further  call 
upon  all  cyberspace  leaders  to  fight  and  overcome  the  en¬ 
demic  bureaucratic  pathologies  that  mitigate  against  the 
needed  change.  Nothing  less  than  the  armed  forces’  ability 
to  fight  and  win  the  nation’s  wars  is  at  risk. 
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